| Package | Affected versions | Patched versions |
|---|---|---|
| cinder | ≤ 24.0.0 | |
| glance | ≤ 28.0.1 | |
| nova | ≤ 29.0.2 | |
| cinder | = 24.0.0≥ 23.0.0, < 23.1.1< 22.1.3 | 23.1.122.1.3 |
| glance | = 27.0.0≥ 28.0.0, < 28.0.2< 26.0.1 | 28.0.226.0.1 |
| nova | ≥ 28.0.0, < 28.1.1≥ 29.0.0, < 29.0.3< 27.3.1 | 28.1.129.0.327.3.1 |
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free