External Control of File Name or Path in Cinder - CVE-2022-47951

Vulnerability identifier: #VU71714

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47951

CWE-ID: CWE-73

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to application allows an attacker to control path of the files when processing VMDK flat images. A remote user can create a specially crafted VMDK flat image that references a specific backing file path and convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

Cinder
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Glance
Debian Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Ubuntu
Red Hat OpenStack Director Deployment Tools
Openstack Nova
venv-openstack-octavia-x86_64
venv-openstack-monasca-ceilometer-x86_64
venv-openstack-monasca-x86_64
venv-openstack-swift-x86_64
python-oslo.utils
python-oslo-utils (Red Hat package)
venv-openstack-murano-x86_64
venv-openstack-freezer-x86_64
venv-openstack-barbican-x86_64
venv-openstack-magnum-x86_64
venv-openstack-designate-x86_64
venv-openstack-manila-x86_64
venv-openstack-aodh-x86_64
venv-openstack-sahara-x86_64
venv-openstack-trove-x86_64
venv-openstack-ceilometer-x86_64
venv-openstack-heat-x86_64
venv-openstack-ironic-x86_64
venv-openstack-neutron-x86_64
openstack-cinder-doc
openstack-cinder-backup
openstack-cinder
openstack-cinder-api
python-cinder
openstack-cinder-volume
openstack-cinder-scheduler
venv-openstack-cinder-x86_64
venv-openstack-keystone-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-horizon-x86_64
python-cinder (Ubuntu package)
openstack-cinder (Red Hat package)
openstack-neutron-gbp
python-neutron-gbp
venv-openstack-glance-x86_64
openstack-glance (Red Hat package)
openstack-nova-doc
openstack-nova-compute
openstack-nova-vncproxy
openstack-nova-scheduler
python-nova
openstack-nova-console
openstack-nova-conductor
openstack-nova
openstack-nova-cells
openstack-nova-novncproxy
openstack-nova-api
openstack-nova-consoleauth
openstack-nova-placement-api
openstack-nova-serialproxy
venv-openstack-nova-x86_64
python3-cinder (Ubuntu package)
openstack-glance
python-glance
openstack-glance-api
cinder (Debian package)
python-nova (Ubuntu package)
nova-common (Ubuntu package)
openstack-nova (Red Hat package)
glance-common (Ubuntu package)
glance (Debian package)
python3-nova (Ubuntu package)
nova (Debian package)

Install update from vendor's website.

Cinder - update to 21.1.0
Glance - update to 25.1.0
Openstack Nova - addressed in versions 24.2.0, 25.1.0, 26.1.0
venv-openstack-octavia-x86_64 - addressed in versions 1.0.6~dev3-12.43.1, 3.2.3~dev7-4.37.1
venv-openstack-monasca-ceilometer-x86_64 - addressed in versions 1.5.1_1.5.1_1.5.1~dev3-8.38.1, 1.8.2~dev3-3.37.1
venv-openstack-monasca-x86_64 - addressed in versions 2.2.2~dev1-11.47.1, 2.7.1~dev10-3.39.1
venv-openstack-swift-x86_64 - addressed in versions 2.15.2_2.15.2_2.15.2~dev32-11.33.1, 2.19.2~dev48-2.32.1
python-oslo.utils - addressed in versions 3.28.4-3.9.1, 3.36.5-3.6.1
python-oslo-utils (Red Hat package) - addressed in versions 3.35.1-5.el7ost, 3.41.6-1.20230130153634.f4deaad.el8ost, 3.41.6-2.20230130154947.f4deaad.el8ost
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.40.1
venv-openstack-freezer-x86_64 - update to 5.0.0.0~xrc2~dev2-10.38.1
venv-openstack-barbican-x86_64 - addressed in versions 5.0.2~dev3-12.45.1, 7.0.1~dev24-3.39.1
venv-openstack-magnum-x86_64 - addressed in versions 5.0.2_5.0.2_5.0.2~dev31-11.42.1, 7.2.1~dev1-4.37.1
venv-openstack-designate-x86_64 - addressed in versions 5.0.3~dev7-12.41.1, 7.0.2~dev2-3.37.1
venv-openstack-manila-x86_64 - addressed in versions 5.1.1~dev5-12.47.1, 7.4.2~dev60-3.43.1
venv-openstack-aodh-x86_64 - update to 5.1.1~dev7-12.42.1
venv-openstack-sahara-x86_64 - addressed in versions 7.0.5~dev4-11.42.1, 9.0.2~dev15-3.37.1
venv-openstack-trove-x86_64 - update to 8.0.2~dev2-11.42.1
venv-openstack-ceilometer-x86_64 - update to 9.0.8~dev7-12.40.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.47.1, 11.0.4~dev4-3.39.1
venv-openstack-ironic-x86_64 - addressed in versions 9.1.8~dev8-12.43.1, 11.1.5~dev18-4.35.1
venv-openstack-neutron-x86_64 - addressed in versions 11.0.9~dev69-13.48.1, 13.0.8~dev209-6.45.1
openstack-cinder-doc - update to 11.2.3~dev29-3.31.1
openstack-cinder-backup - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
openstack-cinder - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
openstack-cinder-api - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
python-cinder - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
openstack-cinder-volume - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
openstack-cinder-scheduler - addressed in versions 11.2.3~dev29-3.31.2, 13.0.10~dev24-3.37.2
venv-openstack-cinder-x86_64 - addressed in versions 11.2.3~dev29-14.44.1, 13.0.10~dev24-3.40.1
venv-openstack-keystone-x86_64 - addressed in versions 12.0.4~dev11-11.47.1, 14.2.1~dev9-3.38.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.50.1
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.50.2, 14.1.1~dev11-4.45.1
python-cinder (Ubuntu package) - update to 2:12.0.10-0ubuntu2.2
openstack-cinder (Red Hat package) - addressed in versions 12.0.10-27.el7ost, 15.4.0-1.20230206163350.58f0e73.el8ost, 15.6.1-2.20221003154726.87578a0.el8ost, 18.2.1-0.20230202190311.1776695.el9ost
openstack-neutron-gbp - update to 14.0.1~dev58-3.40.1
python-neutron-gbp - update to 14.0.1~dev58-3.40.1
venv-openstack-glance-x86_64 - addressed in versions 15.0.3~dev3-12.41.1, 17.0.1~dev30-3.35.1
openstack-glance (Red Hat package) - addressed in versions 16.0.1-13.el7ost, 19.0.4-1.20230207203320.5bbd356.el8ost, 19.0.5-2.20220113204850.b3de9da.el8ost, 22.1.1-0.20220919210603.677c89c.el9ost
openstack-nova-doc - update to 16.1.9~dev92-3.51.1
openstack-nova-compute - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-vncproxy - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-scheduler - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
python-nova - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-console - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-conductor - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-cells - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-novncproxy - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-api - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-consoleauth - update to 16.1.9~dev92-3.51.2
openstack-nova-placement-api - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
openstack-nova-serialproxy - addressed in versions 16.1.9~dev92-3.51.2, 18.3.1~dev92-3.46.1
venv-openstack-nova-x86_64 - addressed in versions 16.1.9~dev92-11.46.1, 18.3.1~dev92-3.45.1
python3-cinder (Ubuntu package) - addressed in versions 2:16.4.2-0ubuntu2.1, 2:16.4.2-0ubuntu2.2, 2:16.4.2-0ubuntu2.9, 2:20.1.0-0ubuntu1, 2:20.3.1-0ubuntu1.5, 2:21.1.0-0ubuntu1, 2:24.0.0-0ubuntu1.3
openstack-glance - update to 17.0.1~dev30-3.6.2
python-glance - update to 17.0.1~dev30-3.6.2
openstack-glance-api - update to 17.0.1~dev30-3.6.2
cinder (Debian package) - update to 2:17.0.1-1+deb11u1
python-nova (Ubuntu package) - update to 2:17.0.13-0ubuntu5.2
nova-common (Ubuntu package) - addressed in versions 2:17.0.13-0ubuntu5.2, 2:21.2.4-0ubuntu2.1, 3:25.1.0-0ubuntu1, 3:26.1.0-0ubuntu1
openstack-nova (Red Hat package) - addressed in versions 17.0.13-40.el7ost, 20.4.1-1.20221005193231.1ee93b9.el8ost, 20.6.2-2.20221005185231.6786e96.el8ost, 23.2.2-0.20221209190753.7074ac0.el9ost
glance-common (Ubuntu package) - addressed in versions 2:20.2.0-0ubuntu1.1, 2:24.1.0-0ubuntu1.1, 2:25.0.0-0ubuntu1.1
glance (Debian package) - update to 2:21.0.0-2+deb11u1
python3-nova (Ubuntu package) - addressed in versions 2:21.2.4-0ubuntu2.1, 3:25.1.0-0ubuntu1, 3:26.1.0-0ubuntu1
nova (Debian package) - update to 2:22.0.1-2+deb11u1

• https://security.openstack.org/ossa/OSSA-2023-002.html

• Information disclosure in OpenStack Cinder
• Information disclosure in OpenStack Glance
• Ubuntu update for nova
• Ubuntu update for cinder
• Ubuntu update for glance
• Information disclosure in OpenStack Nova
• Debian update for cinder
• Debian update for nova
• Debian update for glance
• Ubuntu update for nova
• Ubuntu update for cinder
• Information disclosure in Red Hat OpenStack Platform
• Red Hat OpenStack Platform update for openstack-glance
• Red Hat OpenStack Platform update for openstack-cinder
• Red Hat OpenStack Platform update for openstack-nova
• SUSE update for openstack-cinder, openstack-glance, openstack-neutron-gbp, openstack-nova, python-oslo.utils
• SUSE update for openstack-cinder, openstack-nova, python-oslo.utils
• Ubuntu update for cinder