p PatchFirst

CVE-2020-10755

CVE-2020-10755

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVSS 6.5 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • openstack-cinder

    Versions
    • all openstack-cinder versions before openstack-cinder 14.1.0: Affected
    • all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0: Affected
    • all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0: Affected

    No fix published

  • cinder Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:16.1.0-1

    Update to 2:16.1.0-1

  • cinder Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:16.1.0-1

    Update to 2:16.1.0-1

  • cinder Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:16.1.0-1

    Update to 2:16.1.0-1

  • python-os-brick Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • python-os-brick Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • python-os-brick Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.0-1

    Update to 3.1.0-1

  • cinder PyPI

    Versions
    • 14.0.0
    • 14.0.1
    • 14.0.2
    • 14.0.3
    • 14.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 14.1.0

    Update to 14.1.0

  • cinder PyPI

    Versions
    • 15.0.0
    • 15.0.1
    • 15.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 15.0.0, < 15.2.0

    Update to 15.2.0

  • cinder PyPI

    Versions
    • 16.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 16.0.0, < 16.1.0

    Update to 16.1.0

  • os-brick PyPI

    Versions
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    Affected ranges
    • ECOSYSTEM: ≥ 2.8.0, < 2.8.6

    Update to 2.8.6

  • os-brick PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.10.0, < 2.10.4

    Update to 2.10.4

  • os-brick PyPI

    Versions
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.2

    Update to 3.0.2

  • cinder PyPI

    Versions
    • 10.0.8
    • 11.2.0
    • 11.2.1
    • 11.2.2
    • 12.0.10
    • 12.0.4
    • 12.0.5
    • 12.0.6
    • 12.0.7
    • 12.0.8
    • 12.0.9
    • 13.0.1
    • 13.0.2
    • 13.0.3
    • 13.0.4
    • 13.0.5
    • 13.0.6
    • 13.0.7
    • 13.0.8
    • 13.0.9
    • 14.0.0
    • 14.0.0.0rc1
    • 14.0.0.0rc2
    • 14.0.1
    • 14.0.2
    • 14.0.3
    • 14.0.4
    • 15.0.0
    • 15.0.1
    • 15.1.0
    • 16.0.0
    Affected ranges
    • ECOSYSTEM: < 14.1.0 ∪ ≥ 15.0.0, < 15.2.0 ∪ ≥ 16.0.0, < 16.1.0

    Update to 14.1.0; Update to 15.2.0; Update to 16.1.0

  • os-brick PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.8.0, < 2.8.6 ∪ ≥ 2.10.0, < 2.10.4 ∪ ≥ 3.0.0, < 3.0.2

    Update to 2.8.6; Update to 2.10.4; Update to 3.0.2

  • cinder Ubuntu:16.04:LTS

    Versions
    • 2:7.0.0-0ubuntu1
    • 2:8.0.0~b1-0ubuntu1
    • 2:8.0.0~b2-0ubuntu2
    • 2:8.0.0~b3-0ubuntu2
    • 2:8.0.0~rc1-0ubuntu2
    • 2:8.0.0-0ubuntu1
    • 2:8.1.0-0ubuntu1
    • 2:8.1.1-0ubuntu1
    • 2:8.1.1-0ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-os-brick Ubuntu:16.04:LTS

    Versions
    • 0.5.0-0ubuntu2
    • 0.5.0-2fakesync1
    • 1.1.0-1
    • 1.2.0-2
    • 1.2.0-2ubuntu0.1
    • 1.2.0-2ubuntu0.2
    • 1.2.0-2ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cinder Ubuntu:18.04:LTS

    Versions
    • 2:11.0.0-0ubuntu2
    • 2:11.0.0-0ubuntu3
    • 2:12.0.0~b1-0ubuntu1
    • 2:12.0.0~b2-0ubuntu2
    • 2:12.0.0~rc1-0ubuntu1
    • 2:12.0.0~rc2-0ubuntu1
    • 2:12.0.0~rc2-0ubuntu2
    • 2:12.0.0-0ubuntu1
    • 2:12.0.1-0ubuntu1
    • 2:12.0.3-0ubuntu1
    • 2:12.0.4-0ubuntu1
    • 2:12.0.5-0ubuntu1
    • 2:12.0.7-0ubuntu2
    • 2:12.0.9-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2:12.0.9-0ubuntu1.2

    Update to 2:12.0.9-0ubuntu1.2

  • python-os-brick Ubuntu:18.04:LTS

    Versions
    • 1.15.2-0ubuntu1
    • 2.1.1-0ubuntu1
    • 2.3.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.3.0-0ubuntu1.2

    Update to 2.3.0-0ubuntu1.2

  • cinder Ubuntu:20.04:LTS

    Versions
    • 2:15.0.0-0ubuntu1
    • 2:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu1
    • 2:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu1
    • 2:16.0.0~b3~git2020041012.eb915e2db-0ubuntu1
    • 2:16.0.0-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: < 2:16.1.0-0ubuntu1

    Update to 2:16.1.0-0ubuntu1

  • python-os-brick Ubuntu:20.04:LTS

    Versions
    • 2.10.0-0ubuntu1
    • 2.11.0-0ubuntu1
    • 3.0.0-0ubuntu1
    • 3.0.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.0.1-0ubuntu1.2

    Update to 3.0.1-0ubuntu1.2

Original sources

Check your server →