[SECURITY] [DLA 3302-1] nova security update

2023-01-3022:15:06

lists.debian.org

debian

nova

security

update

cve-2022-47951

vmdk

data access

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.1%

JSON

Debian LTS Advisory DLA-3302-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
January 31, 2023 https://wiki.debian.org/LTS

Package : nova
Version : 2:18.1.0-6+deb10u2
CVE ID : CVE-2022-47951
Debian Bug : 1029561

An issue was discovered in Nova, an OpenStack project that provides a
way to provision compute instances (aka virtual servers). By supplying
a specially created VMDK flat image that references a specific backing
file path, an authenticated user may convince systems to return a copy
of that file's contents from the server, resulting in unauthorized
access to potentially sensitive data.

For Debian 10 buster, this problem has been fixed in version
2:18.1.0-6+deb10u2.

We recommend that you upgrade your nova packages.

For the detailed security status of nova please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nova

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allpython3-glance< 2:17.0.0-5+deb10u1python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian11allnova-compute-ironic< 2:22.0.1-2+deb11u1nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian11allcinder-api< 2:17.0.1-1+deb11u1cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian10allnova-common< 2:18.1.0-6+deb10u2nova-common_2:18.1.0-6+deb10u2_all.deb
Debian10allnova-api< 2:18.1.0-6+deb10u2nova-api_2:18.1.0-6+deb10u2_all.deb
Debian11allnova-api< 2:22.0.1-2+deb11u1nova-api_2:22.0.1-2+deb11u1_all.deb
Debian10allnova-conductor< 2:18.1.0-6+deb10u2nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian11allglance-doc< 2:21.0.0-2+deb11u1glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian10allcinder-scheduler< 2:13.0.7-1+deb10u2cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian10allnova-compute-qemu< 2:18.1.0-6+deb10u2nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	python3-glance	< 2:17.0.0-5+deb10u1	python3-glance_2:17.0.0-5+deb10u1_all.deb
Debian	11	all	nova-compute-ironic	< 2:22.0.1-2+deb11u1	nova-compute-ironic_2:22.0.1-2+deb11u1_all.deb
Debian	11	all	cinder-api	< 2:17.0.1-1+deb11u1	cinder-api_2:17.0.1-1+deb11u1_all.deb
Debian	10	all	nova-common	< 2:18.1.0-6+deb10u2	nova-common_2:18.1.0-6+deb10u2_all.deb
Debian	10	all	nova-api	< 2:18.1.0-6+deb10u2	nova-api_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	nova-api	< 2:22.0.1-2+deb11u1	nova-api_2:22.0.1-2+deb11u1_all.deb
Debian	10	all	nova-conductor	< 2:18.1.0-6+deb10u2	nova-conductor_2:18.1.0-6+deb10u2_all.deb
Debian	11	all	glance-doc	< 2:21.0.0-2+deb11u1	glance-doc_2:21.0.0-2+deb11u1_all.deb
Debian	10	all	cinder-scheduler	< 2:13.0.7-1+deb10u2	cinder-scheduler_2:13.0.7-1+deb10u2_all.deb
Debian	10	all	nova-compute-qemu	< 2:18.1.0-6+deb10u2	nova-compute-qemu_2:18.1.0-6+deb10u2_all.deb