Cinder vulnerability

2015-08-0600:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

64.4%

JSON

Releases

Ubuntu 15.04

Packages

cinder - OpenStack storage service

Details

Bastian Blank discovered that Cinder guessed image formats based on
untrusted data. An attacker could use this to read arbitrary files from
the Cinder host.

OSVersionArchitecturePackageVersionFilename
Ubuntu15.04noarchpython-cinder< 1:2015.1.0-0ubuntu1.1UNKNOWN
Ubuntu15.04noarchcinder-api< 1:2015.1.0-0ubuntu1.1UNKNOWN
Ubuntu15.04noarchcinder-backup< 1:2015.1.0-0ubuntu1.1UNKNOWN
Ubuntu15.04noarchcinder-common< 1:2015.1.0-0ubuntu1.1UNKNOWN
Ubuntu15.04noarchcinder-scheduler< 1:2015.1.0-0ubuntu1.1UNKNOWN
Ubuntu15.04noarchcinder-volume< 1:2015.1.0-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	15.04	noarch	python-cinder	< 1:2015.1.0-0ubuntu1.1	UNKNOWN
Ubuntu	15.04	noarch	cinder-api	< 1:2015.1.0-0ubuntu1.1	UNKNOWN
Ubuntu	15.04	noarch	cinder-backup	< 1:2015.1.0-0ubuntu1.1	UNKNOWN
Ubuntu	15.04	noarch	cinder-common	< 1:2015.1.0-0ubuntu1.1	UNKNOWN
Ubuntu	15.04	noarch	cinder-scheduler	< 1:2015.1.0-0ubuntu1.1	UNKNOWN
Ubuntu	15.04	noarch	cinder-volume	< 1:2015.1.0-0ubuntu1.1	UNKNOWN