Ubuntu 22.10 USN-5835-1 Moderate: Cinder Information Exposure

ubuntu

January 31, 2023

Cinder could be made to expose sensitive information.

Summary

Cinder could be made to expose sensitive information.

Software Description:

- cinder: OpenStack storage service

Details:

Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou

discovered that Cinder incorrectly handled VMDK image processing. An

authenticated attacker could possibly supply a specially crafted VMDK flat

image and obtain arbitrary files from the server containing sensitive

information.

Topics Covered

security advisory moderate security issue Ubuntu update instructions information exposure cinder

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   python3-cinder                  2:21.1.0-0ubuntu1

Ubuntu 22.04 LTS:
   python3-cinder                  2:20.1.0-0ubuntu1

Ubuntu 20.04 LTS:
   python3-cinder                  2:16.4.2-0ubuntu2.1

After a standard system update you need to restart Cinder to make all the
necessary changes.