Ubuntu 23.04 & 22.04 LTS USN-6241-1 Critical: OpenStack Info Exposure

ubuntu

July 24, 2023

OpenStack could be made to expose sensitive information.

Summary

OpenStack could be made to expose sensitive information.

Software Description:

- cinder: OpenStack storage service

- ironic: Openstack bare metal provisioning service

- nova: OpenStack Compute cloud infrastructure

- python-glance-store: OpenStack Image Service store library

- python-os-brick: Library for managing local volume attaches

Details:

Jan Wasilewski and Gorka Eguileor discovered that OpenStack incorrectly

handled deleted volume attachments. An authenticated user or attacker could

possibly use this issue to gain access to sensitive information.

This update may require configuration changes, please see the upstream

advisory and the other links below for more information:

https://discourse.ubuntu.com/t/cve-2023-2088-for-charmed-openstack/37051

Topics Covered

security advisory critical threat information disclosure openstack update ubuntu 22.04 ubuntu 23.04

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   python3-cinder                  2:22.0.0-0ubuntu1.3
   python3-glance-store            4.3.0-0ubuntu1.3
   python3-ironic                  1:21.4.0-0ubuntu1.1
   python3-nova                    3:27.0.0-0ubuntu1.3
   python3-os-brick                6.2.0-0ubuntu2.3

Ubuntu 22.04 LTS:
   python3-cinder                  2:20.2.0-0ubuntu1.1
   python3-glance-store            3.0.0-0ubuntu1.3
   python3-ironic                  1:20.1.0-0ubuntu1.1
   python3-nova                    3:25.1.1-0ubuntu1.1
   python3-os-brick                5.2.2-0ubuntu1.2

In general, a standard system update will make all the necessary changes.