CVE-2024-32498

05.07.2024, 02:15

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitre	CNA	---				---
CISA-ADP	ADP	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Vendor	Product	Version
openstack	cinder	𝑥 < 22.1.3
openstack	cinder	23.0.0 ≤ 𝑥 < 23.1.1
openstack	cinder	24.0.0
openstack	glance	𝑥 < 26.0.1
openstack	glance	28.0.0 ≤ 𝑥 < 28.0.2
openstack	glance	27.0.0
openstack	nova	𝑥 < 27.3.1
openstack	nova	28.0.0 ≤ 𝑥 < 28.1.1
openstack	nova	29.0.0 ≤ 𝑥 < 29.0.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

cinder

bullseye	vulnerable
bullseye (security)	2:17.4.0-1~deb11u2 fixed
bookworm	2:21.3.1-1~deb12u1 fixed
bookworm (security)	2:21.3.1-1~deb12u1 fixed
sid	2:26.0.0-1.1 fixed
trixie	2:26.0.0-1.1 fixed

glance

bullseye	vulnerable
bullseye (security)	2:21.1.0-1+deb11u2 fixed
bookworm	2:25.1.0-2+deb12u1 fixed
bookworm (security)	2:25.1.0-2+deb12u1 fixed
sid	2:30.0.0-1 fixed
trixie	2:30.0.0-1 fixed

nova

bullseye	vulnerable
bullseye (security)	2:22.4.0-1~deb11u5 fixed
bookworm	2:26.2.2-1~deb12u3 fixed
bookworm (security)	2:26.2.2-1~deb12u3 fixed
trixie	2:31.0.0-2 fixed
sid	2:31.0.0-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

cinder

plucky	Fixed 2:24.1.0+git2024080717.383b830b-0ubuntu1 released
oracular	Fixed 2:24.1.0+git2024080717.383b830b-0ubuntu1 released
noble	Fixed 2:24.0.0-0ubuntu1.2 released
mantic	Fixed 2:23.0.0-0ubuntu1.4 released
jammy	Fixed 2:20.3.1-0ubuntu1.4 released
focal	Fixed 2:16.4.2-0ubuntu2.8 released
bionic	needs-triage
xenial	needs-triage

glance

plucky	Fixed 2:28.0.1-0ubuntu3 released
oracular	Fixed 2:28.0.1-0ubuntu3 released
noble	Fixed 2:28.0.1-0ubuntu1.2 released
mantic	Fixed 2:27.0.0-0ubuntu1.2 released
jammy	Fixed 2:24.2.1-0ubuntu1.2 released
focal	Fixed 2:20.2.0-0ubuntu1.2 released
bionic	needs-triage
xenial	needs-triage

nova

plucky	Fixed 3:29.0.1-0ubuntu4 released
oracular	Fixed 3:29.0.1-0ubuntu4 released
noble	Fixed 3:29.0.1-0ubuntu1.3 released
mantic	Fixed 3:28.0.1-0ubuntu1.3 released
jammy	Fixed 3:25.2.1-0ubuntu2.3 released
focal	Fixed 2:21.2.4-0ubuntu2.8 released
bionic	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-552 - Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.

References

http://www.openwall.com/lists/oss-security/2024/07/02/2

https://launchpad.net/bugs/2059809

https://security.openstack.org/ossa/OSSA-2024-001.html

https://www.openwall.com/lists/oss-security/2024/07/02/2

http://www.openwall.com/lists/oss-security/2024/07/02/2

https://launchpad.net/bugs/2059809

https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html

https://www.openwall.com/lists/oss-security/2024/07/02/2