CVE-2020-10755

Publication date 10 June 2020

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user’s volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

Read the notes from the security team

Status

Package Ubuntu Release Status
cinder 24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic
Not affected
22.04 LTS jammy
Not affected
21.10 impish Ignored end of life
21.04 hirsute Ignored end of life
20.10 groovy Ignored end of life
20.04 LTS focal
Fixed 2:16.1.0-0ubuntu1
19.10 eoan Ignored end of life
18.04 LTS bionic
Fixed 2:12.0.9-0ubuntu1.2
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Not in release
python-os-brick 24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic Ignored end of life, was needed
23.04 lunar Ignored end of life, was needed
22.10 kinetic Ignored end of life, was needed
22.04 LTS jammy
Not affected
21.10 impish Ignored end of life
21.04 hirsute Ignored end of life
20.10 groovy Ignored end of life
20.04 LTS focal
Fixed 3.0.1-0ubuntu1.2
19.10 eoan Ignored end of life
18.04 LTS bionic
Fixed 2.3.0-0ubuntu1.2
16.04 LTS xenial
Vulnerable
14.04 LTS trusty Not in release

Notes

mdeslaur

Fixing this moves VxFlex OS passwords from the block_device_mapping table to a file called /opt/emc/scaleio/openstack/connector.conf From python-os-brick patch: It requires that a configuration file be deployed on compute nodes, cinder nodes, and anywhere you would perform a volume attachment in your deployment, when using Cinder with a Dell EMC VxFlex OS backend. If we fix this in stable releases, it will break environments until the new configuration file is deployed.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
python-os-brick

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-4420-1
    • Cinder and os-brick vulnerability
    • 7 July 2020

Other references