CVE-2023-2088

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
VendorProductVersion
redhatopenstack
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cinder
bullseye
no-dsa
buster
no-dsa
bullseye (security)
2:17.4.0-1~deb11u2
fixed
bookworm
2:21.3.1-1~deb12u1
fixed
bookworm (security)
2:21.3.1-1~deb12u1
fixed
trixie
2:25.0.0-2
fixed
sid
2:25.0.0-5
fixed
nova
bullseye
no-dsa
buster
no-dsa
bullseye (security)
vulnerable
bookworm
2:26.2.2-1~deb12u3
fixed
bookworm (security)
2:26.2.2-1~deb12u3
fixed
trixie
2:30.0.0-4
fixed
sid
2:30.0.0-5
fixed
python-glance-store
bullseye
no-dsa
buster
no-dsa
bookworm
4.1.0-4
fixed
trixie
4.8.1-3
fixed
sid
4.8.1-3
fixed
python-os-brick
bullseye
no-dsa
buster
no-dsa
bookworm
6.1.0-3
fixed
trixie
6.9.0-3
fixed
sid
6.9.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cinder
lunar
Fixed 2:22.0.0-0ubuntu1.3
released
kinetic
ignored
jammy
Fixed 2:20.2.0-0ubuntu1.1
released
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
ironic
lunar
Fixed 1:21.4.0-0ubuntu1.1
released
kinetic
ignored
jammy
Fixed 1:20.1.0-0ubuntu1.1
released
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
nova
lunar
Fixed 3:27.0.0-0ubuntu1.3
released
kinetic
ignored
jammy
Fixed 3:25.1.1-0ubuntu1.1
released
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
python-glance-store
lunar
Fixed 4.3.0-0ubuntu1.3
released
kinetic
ignored
jammy
Fixed 3.0.0-0ubuntu1.3
released
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
python-os-brick
lunar
Fixed 6.2.0-0ubuntu2.3
released
kinetic
ignored
jammy
Fixed 5.2.2-0ubuntu1.2
released
focal
ignored
bionic
ignored
xenial
ignored
trusty
ignored
Common Weakness Enumeration
References
https://bugs.launchpad.net/bugs/2004555
https://security.openstack.org/ossa/OSSA-2023-003.html
https://bugs.launchpad.net/bugs/2004555
https://lists.debian.org/debian-lts-announce/2024/09/msg00015.html
https://security.openstack.org/ossa/OSSA-2023-003.html