USN-6882-2: Cinder regression

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• cinder - OpenStack storage service

Details

USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression
in certain environments due to incorrect privilege handling. This update
fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image
processing. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• python3-cinder - 2:24.0.0-0ubuntu1.3

Ubuntu 22.04

• python3-cinder - 2:20.3.1-0ubuntu1.5

Ubuntu 20.04

• python3-cinder - 2:16.4.2-0ubuntu2.9

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-32498
• CVE-2022-47951

Related notices

• USN-6882-1: cinder-volume, python3-cinder, cinder-backup, cinder, cinder-api, cinder-common, cinder-scheduler
• USN-6883-1: python-glance-doc, python3-glance, glance, glance-api, glance-common
• USN-6884-1: nova-compute-ironic, nova-common, nova-spiceproxy, nova-volume, nova-api-os-volume, nova, nova-api-os-compute, nova-compute-libvirt, nova-compute-vmware, nova-api, nova-ajax-console-proxy, nova-novncproxy, nova-compute, nova-doc, nova-cells, nova-compute-lxc, nova-scheduler, nova-compute-qemu, nova-compute-kvm, nova-compute-xen, nova-api-metadata, nova-conductor, python3-nova, nova-serialproxy
• USN-5835-1: cinder-volume, python3-cinder, cinder-backup, cinder, cinder-api, cinder-common, cinder-scheduler
• USN-5835-2: python-glance-doc, python3-glance, glance, glance-api, glance-common
• USN-5835-3: nova-compute-ironic, nova-common, nova-spiceproxy, nova-volume, nova-api-os-volume, nova, nova-api-os-compute, nova-compute-libvirt, nova-compute-vmware, nova-api, nova-ajax-console-proxy, nova-novncproxy, nova-compute, nova-doc, nova-cells, nova-compute-lxc, nova-scheduler, nova-compute-qemu, nova-compute-kvm, nova-compute-xen, nova-api-metadata, nova-conductor, python3-nova, nova-serialproxy
• USN-5835-4: cinder-volume, python3-cinder, python-cinder, cinder-backup, cinder, cinder-api, cinder-common, cinder-scheduler
• USN-5835-5: python-nova, nova-common, nova-spiceproxy, nova-volume, nova-xvpvncproxy, nova-api-os-volume, nova-placement-api, nova, nova-network, nova-api-os-compute, nova-consoleauth, nova-compute-libvirt, nova-compute-vmware, nova-api, nova-ajax-console-proxy, nova-novncproxy, nova-compute, nova-doc, nova-cells, nova-compute-lxc, nova-scheduler, nova-compute-qemu, nova-compute-kvm, nova-compute-xen, nova-console, nova-api-metadata, nova-conductor, nova-serialproxy