USN-5835-4: Cinder vulnerability
9 February 2023
Cinder could be made to expose sensitive information.
Releases
Packages
- cinder - OpenStack storage service
Details
USN-5835-1 fixed vulnerabilities in Cinder. This update provides the
corresponding updates for Ubuntu 18.04 LTS. In addition, a regression was
fixed for Ubuntu 20.04 LTS.
Original advisory details:
Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou
discovered that Cinder incorrectly handled VMDK image processing. An
authenticated attacker could possibly supply a specially crafted VMDK flat
image and obtain arbitrary files from the server containing sensitive
information.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
After a standard system update you need to restart Cinder to make all the
References
Related notices
- USN-5835-1: cinder-api, cinder-common, cinder-scheduler, python3-cinder, cinder-backup, cinder-volume, cinder
- USN-5835-2: python-glance-doc, glance-common, glance, python3-glance, glance-api
- USN-5835-3: nova-scheduler, nova-compute-qemu, nova-api-os-compute, nova-compute-libvirt, nova-compute, python3-nova, nova-ajax-console-proxy, nova-serialproxy, nova-spiceproxy, nova-volume, nova-cells, nova-api, nova-compute-xen, nova-compute-ironic, nova-novncproxy, nova-compute-vmware, nova-common, nova-conductor, nova-api-os-volume, nova-doc, nova-compute-lxc, nova, nova-api-metadata, nova-compute-kvm
- USN-5835-5: nova-scheduler, nova-console, nova-consoleauth, nova-compute-qemu, nova-api-os-compute, nova-compute-libvirt, nova-compute, nova-network, nova-ajax-console-proxy, nova-serialproxy, nova-spiceproxy, nova-xvpvncproxy, nova-volume, nova-cells, nova-api, nova-compute-xen, nova-novncproxy, nova-compute-vmware, nova-common, nova-conductor, nova-api-os-volume, nova-doc, python-nova, nova-compute-lxc, nova-placement-api, nova, nova-api-metadata, nova-compute-kvm