OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots

BASSO 2.1CVE-2013-4183 · GHSA-q3rw-wcj6-8cjf · PYSEC-2013-35 · Published 16/09/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
cinder PyPI	`< 7.0.0a0`	`7.0.0a0`
cinder openstack	`= 2013.1.1= 2013.1.2`	No fix yet

Description

The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-4183 · ADVISORY
openstack/cinder commit 0ee3107 · WEB
openstack/cinder commit 68c597e · WEB
bugs.launchpad.net/cinder/+bug/1198185 · WEB
openstack/cinder · PACKAGE
pypa/advisory-database · WEB
rhn.redhat.com/errata/RHSA-2013-1198.html · WEB
ubuntu.com/usn/USN-2005-1 · WEB
rhn.redhat.com/errata/RHSA-2013-1198.html · Patch
ubuntu.com/usn/USN-2005-1

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free