Ubuntu update for cinder

Published: 2024-11-07

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-32498 CVE-2022-47951
CWE-ID	CWE-200 CWE-73
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system python3-cinder (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU96373

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32498

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of file paths inside a QCOW2 image. A remote user can supply a specially crafted QCOW2 image that references a specific data file path and view the contents of the file.

Mitigation

Update the affected package cinder to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

python3-cinder (Ubuntu package): before 2:16.4.2-0ubuntu2.9

CPE2.3

External links

https://ubuntu.com/security/notices/USN-6882-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) External Control of File Name or Path

EUVDB-ID: #VU71714

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-47951

CWE-ID: CWE-73 - External Control of File Name or Path