OpenStack Cinder file disclosure in image convert

MEDIUM 6.8CVE-2015-1851 · GHSA-9hcj-h2qc-689p · PYSEC-2026-789 · Published 25/06/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
cinder PyPI	`< 7.0.0a0`	`7.0.0a0`
icehouse openstack	`≤ 2014.1.4`	No fix yet
juno openstack	`= 2014.2= 2014.2.2= 2014.2.3`	No fix yet
kilo openstack	`= 2015.1.0`	No fix yet

Description

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-1851 · ADVISORY
openstack/cinder commit 9634b76 · WEB
openstack/cinder commit b1143ee · WEB
openstack/cinder commit bc0549e · WEB
openstack/cinder commit d31c937 · WEB
bugs.launchpad.net/cinder/+bug/1415087 · WEB
openstack/cinder · PACKAGE
lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html · WEB
rhn.redhat.com/errata/RHSA-2015-1206.html · WEB
debian.org/security/2015/dsa-3292 · WEB
openwall.com/lists/oss-security/2015/06/13/1 · WEB
openwall.com/lists/oss-security/2015/06/17/2 · WEB
openwall.com/lists/oss-security/2015/06/17/7 · WEB
ubuntu.com/usn/USN-2703-1 · WEB
pypi.org/project/cinder · PACKAGE
GitHub Advisory GHSA-9hcj-h2qc-689p · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free