CVE-2022-47951
CVE-2022-47951
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
CVSS 5.7 · Medium · EPSS 1.0% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
cinder Debian:12
- Affected ranges
- ECOSYSTEM: < 2:21.0.0-3
Update to 2:21.0.0-3
cinder Debian:13
- Affected ranges
- ECOSYSTEM: < 2:21.0.0-3
Update to 2:21.0.0-3
cinder Debian:14
- Affected ranges
- ECOSYSTEM: < 2:21.0.0-3
Update to 2:21.0.0-3
glance Debian:12
- Affected ranges
- ECOSYSTEM: < 2:25.0.0-2
Update to 2:25.0.0-2
glance Debian:13
- Affected ranges
- ECOSYSTEM: < 2:25.0.0-2
Update to 2:25.0.0-2
glance Debian:14
- Affected ranges
- ECOSYSTEM: < 2:25.0.0-2
Update to 2:25.0.0-2
nova Debian:12
- Affected ranges
- ECOSYSTEM: < 2:26.0.0-6
Update to 2:26.0.0-6
nova Debian:13
- Affected ranges
- ECOSYSTEM: < 2:26.0.0-6
Update to 2:26.0.0-6
nova Debian:14
- Affected ranges
- ECOSYSTEM: < 2:26.0.0-6
Update to 2:26.0.0-6
cinder PyPI
- Versions
- 10.0.8
- 11.2.0
- 11.2.1
- 11.2.2
- 12.0.10
- 12.0.4
- 12.0.5
- 12.0.6
- 12.0.7
- 12.0.8
- 12.0.9
- 13.0.1
- 13.0.2
- 13.0.3
- 13.0.4
- 13.0.5
- 13.0.6
- 13.0.7
- 13.0.8
- 13.0.9
- 14.0.0
- 14.0.0.0rc1
- 14.0.0.0rc2
- 14.0.1
- 14.0.2
- 14.0.3
- 14.0.4
- 14.1.0
- 14.2.0
- 14.2.1
- 14.3.0
- 14.3.1
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 15.1.0
- 15.2.0
- 15.3.0
- 15.4.0
- 15.4.1
- 15.5.0
- 15.6.0
- 16.0.0
- 16.0.0.0b1
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.0.0rc3
- 16.1.0
- 16.2.0
- 16.2.1
- 16.3.0
- 16.4.0
- 16.4.1
- 16.4.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 17.1.0
- 17.2.0
- 17.3.0
- 17.4.0
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.0.0rc2
- 18.1.0
- 18.2.0
- 18.2.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.1.0
- 19.1.1
- Affected ranges
- ECOSYSTEM: < 19.1.2
Update to 19.1.2
cinder PyPI
- Versions
- 20.0.0
- 20.0.1
- Affected ranges
- ECOSYSTEM: ≥ 20.0.0, < 20.0.2
Update to 20.0.2
glance PyPI
- Versions
- 15.0.2
- 17.0.1
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.0.4
- 20.0.0
- 20.0.0.0b1
- 20.0.0.0b2
- 20.0.0.0b3
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.2.0
- 21.0.0
- 21.0.0.0b1
- 21.0.0.0b2
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 22.0.0
- 22.0.0.0b2
- 22.0.0.0b3
- 22.0.0.0rc1
- 22.1.0
- 22.1.1
- 23.0.0
- 23.0.0.0b2
- 23.0.0.0b3
- 23.0.0.0rc1
- 23.0.0.0rc2
- Affected ranges
- ECOSYSTEM: < 23.0.1
Update to 23.0.1
glance PyPI
- Versions
- 24.0.0
- 24.1.0
- Affected ranges
- ECOSYSTEM: ≥ 24.0.0, < 24.1.1
Update to 24.1.1
nova PyPI
- Versions
- 15.1.5
- 16.1.6
- 16.1.7
- 16.1.8
- 17.0.10
- 17.0.11
- 17.0.12
- 17.0.13
- 17.0.7
- 17.0.8
- 17.0.9
- 18.0.2
- 18.0.3
- 18.1.0
- 18.2.0
- 18.2.1
- 18.2.2
- 18.2.3
- 18.3.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1.0
- 19.2.0
- 19.3.0
- 19.3.1
- 19.3.2
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.1.1
- 20.2.0
- 20.3.0
- 20.4.0
- 20.4.1
- 20.5.0
- 20.6.0
- 20.6.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 21.1.1
- 21.1.2
- 21.2.0
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.1.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.0.1
- 23.0.2
- 23.1.0
- 23.2.0
- 23.2.1
- 23.2.2
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- 24.1.0
- 24.1.1
- Affected ranges
- ECOSYSTEM: < 24.1.2
Update to 24.1.2
nova PyPI
- Versions
- 25.0.0
- 25.0.1
- Affected ranges
- ECOSYSTEM: ≥ 25.0.0, < 25.0.2
Update to 25.0.2
cinder PyPI
- Versions
- 10.0.8
- 11.2.0
- 11.2.1
- 11.2.2
- 12.0.10
- 12.0.4
- 12.0.5
- 12.0.6
- 12.0.7
- 12.0.8
- 12.0.9
- 13.0.1
- 13.0.2
- 13.0.3
- 13.0.4
- 13.0.5
- 13.0.6
- 13.0.7
- 13.0.8
- 13.0.9
- 14.0.0
- 14.0.0.0rc1
- 14.0.0.0rc2
- 14.0.1
- 14.0.2
- 14.0.3
- 14.0.4
- 14.1.0
- 14.2.0
- 14.2.1
- 14.3.0
- 14.3.1
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 15.1.0
- 15.2.0
- 15.3.0
- 15.4.0
- 15.4.1
- 15.5.0
- 15.6.0
- 16.0.0
- 16.0.0.0b1
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.0.0rc3
- 16.1.0
- 16.2.0
- 16.2.1
- 16.3.0
- 16.4.0
- 16.4.1
- 16.4.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 17.1.0
- 17.2.0
- 17.3.0
- 17.4.0
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.0.0rc2
- 18.1.0
- 18.2.0
- 18.2.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.1.0
- 19.1.1
- 20.0.0
- 20.0.1
- Affected ranges
- ECOSYSTEM: < 19.1.2 ∪ ≥ 20.0.0, < 20.0.2
Update to 19.1.2; Update to 20.0.2
glance PyPI
- Versions
- 15.0.2
- 17.0.1
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.0.4
- 20.0.0
- 20.0.0.0b1
- 20.0.0.0b2
- 20.0.0.0b3
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.2.0
- 21.0.0
- 21.0.0.0b1
- 21.0.0.0b2
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 22.0.0
- 22.0.0.0b2
- 22.0.0.0b3
- 22.0.0.0rc1
- 22.1.0
- 22.1.1
- 23.0.0
- 23.0.0.0b2
- 23.0.0.0b3
- 23.0.0.0rc1
- 23.0.0.0rc2
- 24.0.0
- 24.1.0
- Affected ranges
- ECOSYSTEM: < 23.0.1 ∪ ≥ 24.0.0, < 24.1.1
Update to 23.0.1; Update to 24.1.1
nova PyPI
- Versions
- 15.1.5
- 16.1.6
- 16.1.7
- 16.1.8
- 17.0.10
- 17.0.11
- 17.0.12
- 17.0.13
- 17.0.7
- 17.0.8
- 17.0.9
- 18.0.2
- 18.0.3
- 18.1.0
- 18.2.0
- 18.2.1
- 18.2.2
- 18.2.3
- 18.3.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1.0
- 19.2.0
- 19.3.0
- 19.3.1
- 19.3.2
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.1.1
- 20.2.0
- 20.3.0
- 20.4.0
- 20.4.1
- 20.5.0
- 20.6.0
- 20.6.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 21.1.1
- 21.1.2
- 21.2.0
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.1.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.0.1
- 23.0.2
- 23.1.0
- 23.2.0
- 23.2.1
- 23.2.2
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- 24.1.0
- 24.1.1
- 25.0.0
- 25.0.1
- Affected ranges
- ECOSYSTEM: < 24.1.2 ∪ ≥ 25.0.0, < 25.0.2
Update to 24.1.2; Update to 25.0.2
cinder Ubuntu:16.04:LTS
- Versions
- 2:7.0.0-0ubuntu1
- 2:8.0.0~b1-0ubuntu1
- 2:8.0.0~b2-0ubuntu2
- 2:8.0.0~b3-0ubuntu2
- 2:8.0.0~rc1-0ubuntu2
- 2:8.0.0-0ubuntu1
- 2:8.1.0-0ubuntu1
- 2:8.1.1-0ubuntu1
- 2:8.1.1-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nova Ubuntu:Pro:16.04:LTS
- Versions
- 2:12.0.0-0ubuntu2
- 2:13.0.0~b1-0ubuntu1
- 2:13.0.0~b2-0ubuntu1
- 2:13.0.0~b3-0ubuntu1
- 2:13.0.0~rc1-0ubuntu1
- 2:13.0.0~rc3-0ubuntu1
- 2:13.0.0-0ubuntu1
- 2:13.0.0-0ubuntu2
- 2:13.0.0-0ubuntu5
- 2:13.1.0-0ubuntu1
- 2:13.1.1-0ubuntu1
- 2:13.1.1-0ubuntu1.1
- 2:13.1.2-0ubuntu2
- 2:13.1.3-0ubuntu1
- 2:13.1.3-0ubuntu2
- 2:13.1.4-0ubuntu1
- 2:13.1.4-0ubuntu2
- 2:13.1.4-0ubuntu3
- 2:13.1.4-0ubuntu4.1
- 2:13.1.4-0ubuntu4.2
- 2:13.1.4-0ubuntu4.3
- 2:13.1.4-0ubuntu4.4
- 2:13.1.4-0ubuntu4.5
- 2:13.1.4-0ubuntu4.5+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cinder Ubuntu:18.04:LTS
- Versions
- 2:11.0.0-0ubuntu2
- 2:11.0.0-0ubuntu3
- 2:12.0.0~b1-0ubuntu1
- 2:12.0.0~b2-0ubuntu2
- 2:12.0.0~rc1-0ubuntu1
- 2:12.0.0~rc2-0ubuntu1
- 2:12.0.0~rc2-0ubuntu2
- 2:12.0.0-0ubuntu1
- 2:12.0.1-0ubuntu1
- 2:12.0.3-0ubuntu1
- 2:12.0.4-0ubuntu1
- 2:12.0.5-0ubuntu1
- 2:12.0.7-0ubuntu2
- 2:12.0.9-0ubuntu1
- 2:12.0.9-0ubuntu1.2
- 2:12.0.10-0ubuntu1
- 2:12.0.10-0ubuntu2
- Affected ranges
- ECOSYSTEM: < 2:12.0.10-0ubuntu2.2
Update to 2:12.0.10-0ubuntu2.2
nova Ubuntu:18.04:LTS
- Versions
- 2:16.0.1-0ubuntu1
- 2:16.0.1-0ubuntu2
- 2:17.0.0~b1-0ubuntu1
- 2:17.0.0~b2-0ubuntu2
- 2:17.0.0~b3-0ubuntu3
- 2:17.0.0~b3-0ubuntu4
- 2:17.0.0~rc1-0ubuntu1
- 2:17.0.0~rc2-0ubuntu1
- 2:17.0.0~rc3-0ubuntu1
- 2:17.0.0-0ubuntu1
- 2:17.0.1-0ubuntu1
- 2:17.0.3-0ubuntu1
- 2:17.0.4-0ubuntu1
- 2:17.0.5-0ubuntu1
- 2:17.0.5-0ubuntu2
- 2:17.0.6-0ubuntu1
- 2:17.0.7-0ubuntu1
- 2:17.0.7-0ubuntu2
- 2:17.0.9-0ubuntu1
- 2:17.0.9-0ubuntu3
- 2:17.0.10-0ubuntu2
- 2:17.0.10-0ubuntu2.1
- 2:17.0.11-0ubuntu1
- 2:17.0.12-0ubuntu1
- 2:17.0.13-0ubuntu1
- 2:17.0.13-0ubuntu2
- 2:17.0.13-0ubuntu3
- 2:17.0.13-0ubuntu4
- 2:17.0.13-0ubuntu5
- Affected ranges
- ECOSYSTEM: < 2:17.0.13-0ubuntu5.2
Update to 2:17.0.13-0ubuntu5.2
cinder Ubuntu:20.04:LTS
- Versions
- 2:15.0.0-0ubuntu1
- 2:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu1
- 2:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu1
- 2:16.0.0~b3~git2020041012.eb915e2db-0ubuntu1
- 2:16.0.0-0ubuntu0.20.04.1
- 2:16.1.0-0ubuntu1
- 2:16.2.0-0ubuntu1
- 2:16.2.1-0ubuntu1
- 2:16.2.1-0ubuntu2
- 2:16.3.0-0ubuntu1
- 2:16.4.0-0ubuntu1
- 2:16.4.1-0ubuntu1
- 2:16.4.2-0ubuntu2
- Affected ranges
- ECOSYSTEM: < 2:16.4.2-0ubuntu2.1
Update to 2:16.4.2-0ubuntu2.1
Original sources
- https://launchpad.net/bugs/1996188
- https://security.openstack.org/ossa/OSSA-2023-002.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00040.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00041.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00042.html
- https://www.debian.org/security/2023/dsa-5336
- https://www.debian.org/security/2023/dsa-5338
- https://www.debian.org/security/2023/dsa-5337
- https://nvd.nist.gov/vuln/detail/CVE-2022-47951