Ubuntu 22.10 USN-5835-2 Moderate OpenStack Glance Info Leak

ubuntu

January 31, 2023

OpenStack Glance could be made to expose sensitive information.

Summary

OpenStack Glance could be made to expose sensitive information.

Software Description:

- glance: OpenStack Image Registry and Delivery Service

Details:

Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou

discovered that OpenStack Glance incorrectly handled VMDK image processing.

An authenticated attacker could possibly supply a specially crafted VMDK

flat image and obtain arbitrary files from the server containing sensitive

information.

Topics Covered

security advisory moderate Ubuntu information exposure OpenStack glance

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   glance-common                   2:25.0.0-0ubuntu1.1

Ubuntu 22.04 LTS:
   glance-common                   2:24.1.0-0ubuntu1.1

Ubuntu 20.04 LTS:
   glance-common                   2:20.2.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.