Ubuntu 24.04 LTS: USN-6882-1 Critical: Cinder File Access Issue

ubuntu

July 8, 2024

Cinder would allow unintended access to files over the network.

Summary

Cinder would allow unintended access to files over the network.

Software Description:

- cinder: OpenStack storage service

Details:

Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image

processing. An authenticated user could use this issue to access arbitrary

files on the server, possibly exposing sensitive information.

Topics Covered

security advisory security issue Ubuntu file access OpenStack Cinder

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   python3-cinder                  2:24.0.0-0ubuntu1.2

Ubuntu 23.10
   python3-cinder                  2:23.0.0-0ubuntu1.4

Ubuntu 22.04 LTS
   python3-cinder                  2:20.3.1-0ubuntu1.4

Ubuntu 20.04 LTS
   python3-cinder                  2:16.4.2-0ubuntu2.8

In general, a standard system update will make all the necessary changes.