CVE-2015-1851

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:C/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
canonicalubuntu_linux
15.04
openstackicehouse
𝑥
≤ 2014.1.4
openstackjuno
2014.2
openstackjuno
2014.2.2
openstackjuno
2014.2.3
openstackkilo
2015.1.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cinder
bullseye
2:17.0.1-1+deb11u1
fixed
bullseye (security)
2:17.4.0-1~deb11u2
fixed
bookworm
2:21.3.1-1~deb12u1
fixed
bookworm (security)
2:21.3.1-1~deb12u1
fixed
sid
2:25.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cinder
vivid
Fixed 1:2015.1.0-0ubuntu1.1
released
utopic
ignored
trusty
dne
precise
dne
Common Weakness Enumeration
References
http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html
http://rhn.redhat.com/errata/RHSA-2015-1206.html
http://www.debian.org/security/2015/dsa-3292
http://www.openwall.com/lists/oss-security/2015/06/13/1
http://www.openwall.com/lists/oss-security/2015/06/17/2
http://www.openwall.com/lists/oss-security/2015/06/17/7
http://www.ubuntu.com/usn/USN-2703-1
https://bugs.launchpad.net/cinder/+bug/1415087
http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html
http://rhn.redhat.com/errata/RHSA-2015-1206.html
http://www.debian.org/security/2015/dsa-3292
http://www.openwall.com/lists/oss-security/2015/06/13/1
http://www.openwall.com/lists/oss-security/2015/06/17/2
http://www.openwall.com/lists/oss-security/2015/06/17/7
http://www.ubuntu.com/usn/USN-2703-1
https://bugs.launchpad.net/cinder/+bug/1415087