[SECURITY] [DLA 3301-1] cinder security update

2023-01-3022:10:12

lists.debian.org

openstack

cinder

debian

unauthorized access

cve-2022-47951

vmdk

security update

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.1%

JSON

Debian LTS Advisory DLA-3301-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
January 31, 2023 https://wiki.debian.org/LTS

Package : cinder
Version : 2:13.0.7-1+deb10u2
CVE ID : CVE-2022-47951
Debian Bug : 1029562

An issue was discovered in OpenStack Cinder, a Block Storage service
for OpenStack. By supplying a specially created VMDK flat image that
references a specific backing file path, an authenticated user may
convince systems to return a copy of that file's contents from the
server, resulting in unauthorized access to potentially sensitive data.

For Debian 10 buster, this problem has been fixed in version
2:13.0.7-1+deb10u2.

We recommend that you upgrade your cinder packages.

For the detailed security status of cinder please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cinder

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allpython3-glance< 2:17.0.0-5+deb10u1python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian11allnova-compute-ironic< 2:22.0.1-2+deb11u1nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian11allcinder-api< 2:17.0.1-1+deb11u1cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian10allnova-common< 2:18.1.0-6+deb10u2nova-common_2:18.1.0-6+deb10u2_all.deb
Debian10allnova-api< 2:18.1.0-6+deb10u2nova-api_2:18.1.0-6+deb10u2_all.deb
Debian11allnova-api< 2:22.0.1-2+deb11u1nova-api_2:22.0.1-2+deb11u1_all.deb
Debian10allnova-conductor< 2:18.1.0-6+deb10u2nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian11allglance-doc< 2:21.0.0-2+deb11u1glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian10allcinder-scheduler< 2:13.0.7-1+deb10u2cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian10allnova-compute-qemu< 2:18.1.0-6+deb10u2nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	python3-glance	< 2:17.0.0-5+deb10u1	python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian	11	all	nova-compute-ironic	< 2:22.0.1-2+deb11u1	nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian	11	all	cinder-api	< 2:17.0.1-1+deb11u1	cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian	10	all	nova-common	< 2:18.1.0-6+deb10u2	nova-common_2:18.1.0-6+deb10u2_all.deb
Debian	10	all	nova-api	< 2:18.1.0-6+deb10u2	nova-api_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	nova-api	< 2:22.0.1-2+deb11u1	nova-api_2:22.0.1-2+deb11u1_all.deb
Debian	10	all	nova-conductor	< 2:18.1.0-6+deb10u2	nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	glance-doc	< 2:21.0.0-2+deb11u1	glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian	10	all	cinder-scheduler	< 2:13.0.7-1+deb10u2	cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian	10	all	nova-compute-qemu	< 2:18.1.0-6+deb10u2	nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb