OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

MEDIUM 4.0CVE-2014-3641 · GHSA-qhch-g8qr-p497 · PYSEC-2026-791 · Published 08/10/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
cinder PyPI	`< 2014.1.3`	`2014.1.3`
cinder openstack	`= 2014.1.1≤ 2014.1.2`	No fix yet

Description

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-3641 · ADVISORY
access.redhat.com/errata/RHSA-2014:1787 · WEB
access.redhat.com/errata/RHSA-2014:1788 · WEB
access.redhat.com/security/cve/CVE-2014-3641 · WEB
bugs.launchpad.net/cinder/+bug/1350504 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
opendev.org/openstack/cinder · PACKAGE
web.archive.org/web/20200228053848/http://www.securityfocus.com/bid/70221 · WEB
rhn.redhat.com/errata/RHSA-2014-1787.html · WEB
rhn.redhat.com/errata/RHSA-2014-1788.html · WEB
seclists.org/oss-sec/2014/q4/78 · WEB
ubuntu.com/usn/USN-2405-1 · WEB
securityfocus.com/bid/70221
pypi.org/project/cinder · PACKAGE
GitHub Advisory GHSA-qhch-g8qr-p497 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free