Ubuntu: 4420-1 Moderate: Cinder and Os-Brick Sensitive Data Exposure

ubuntu

July 7, 2020

Cinder and os-brick could be made to expose sensitive information.

Summary

Cinder and os-brick could be made to expose sensitive information.

Software Description:

- cinder: OpenStack storage service

- python-os-brick: Library for managing local volume attaches

Details:

David Hill and Eric Harney discovered that Cinder and os-brick incorrectly

handled ScaleIO backend credentials. An attacker could possibly use this issue to

expose sensitive information.

Topics Covered

security advisory exposure ubuntu sensitive information credentials cinder os-brick

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  python3-cinder                  2:16.1.0-0ubuntu1
  python3-os-brick                3.0.1-0ubuntu1.2

Ubuntu 18.04 LTS:
  python-cinder                   2:12.0.9-0ubuntu1.2
  python-os-brick                 2.3.0-0ubuntu1.2
  python3-os-brick                2.3.0-0ubuntu1.2

In general, a standard system update will make all the necessary changes.