CVE-2024-32498
CVE-2024-32498
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
CVSS 6.5 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
cinder Debian:12
- Versions
- 2:21.1.0-3
- Affected ranges
- ECOSYSTEM: < 2:21.3.1-1~deb12u1
Update to 2:21.3.1-1~deb12u1
cinder Debian:13
- Affected ranges
- ECOSYSTEM: < 2:24.0.0-5
Update to 2:24.0.0-5
cinder Debian:14
- Affected ranges
- ECOSYSTEM: < 2:24.0.0-5
Update to 2:24.0.0-5
glance Debian:12
- Versions
- 2:25.1.0-2
- Affected ranges
- ECOSYSTEM: < 2:25.1.0-2+deb12u1
Update to 2:25.1.0-2+deb12u1
glance Debian:13
- Affected ranges
- ECOSYSTEM: < 2:28.0.1-3+deb12u1
Update to 2:28.0.1-3+deb12u1
glance Debian:14
- Affected ranges
- ECOSYSTEM: < 2:28.0.1-3+deb12u1
Update to 2:28.0.1-3+deb12u1
nova Debian:12
- Versions
- 2:26.1.0-4
- Affected ranges
- ECOSYSTEM: < 2:26.2.2-1~deb12u3
Update to 2:26.2.2-1~deb12u3
nova Debian:13
- Affected ranges
- ECOSYSTEM: < 2:29.0.2-4
Update to 2:29.0.2-4
nova Debian:14
- Affected ranges
- ECOSYSTEM: < 2:29.0.2-4
Update to 2:29.0.2-4
cinder PyPI
- Versions
- 10.0.8
- 11.2.0
- 11.2.1
- 11.2.2
- 12.0.10
- 12.0.4
- 12.0.5
- 12.0.6
- 12.0.7
- 12.0.8
- 12.0.9
- 13.0.1
- 13.0.2
- 13.0.3
- 13.0.4
- 13.0.5
- 13.0.6
- 13.0.7
- 13.0.8
- 13.0.9
- 14.0.0
- 14.0.0.0rc1
- 14.0.0.0rc2
- 14.0.1
- 14.0.2
- 14.0.3
- 14.0.4
- 14.1.0
- 14.2.0
- 14.2.1
- 14.3.0
- 14.3.1
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 15.1.0
- 15.2.0
- 15.3.0
- 15.4.0
- 15.4.1
- 15.5.0
- 15.6.0
- 16.0.0
- 16.0.0.0b1
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.0.0rc3
- 16.1.0
- 16.2.0
- 16.2.1
- 16.3.0
- 16.4.0
- 16.4.1
- 16.4.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 17.1.0
- 17.2.0
- 17.3.0
- 17.4.0
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.0.0rc2
- 18.1.0
- 18.2.0
- 18.2.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.1.0
- 19.1.1
- 19.2.0
- 19.3.0
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.2.0
- 20.3.0
- 20.3.1
- 20.3.2
- 21.0.0
- 21.0.0.0rc2
- 21.1.0
- 21.2.0
- 21.3.0
- 21.3.1
- 21.3.2
- 22.0.0
- 22.0.0.0rc1
- 22.0.0.0rc2
- 22.1.0
- 22.1.1
- 22.1.2
- 22.2.0
- 22.3.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.1.0
- 23.2.0
- 23.3.0
- 23.4.0
- 23.5.0
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- Affected ranges
- ECOSYSTEM: ≤ 24.0.0
No fix published
glance PyPI
- Versions
- 15.0.2
- 17.0.1
- 18.0.0
- 18.0.0.0b1
- 18.0.0.0rc1
- 18.0.1
- 19.0.0
- 19.0.0.0b1
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.0.4
- 20.0.0
- 20.0.0.0b1
- 20.0.0.0b2
- 20.0.0.0b3
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.2.0
- 21.0.0
- 21.0.0.0b1
- 21.0.0.0b2
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 22.0.0
- 22.0.0.0b2
- 22.0.0.0b3
- 22.0.0.0rc1
- 22.1.0
- 22.1.1
- 23.0.0
- 23.0.0.0b2
- 23.0.0.0b3
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.1.0
- 24.0.0
- 24.0.0.0rc1
- 24.1.0
- 24.2.0
- 24.2.1
- 25.0.0
- 25.0.0.0b2
- 25.0.0.0b3
- 25.0.0.0rc1
- 25.1.0
- 26.0.0
- 26.0.0.0b2
- 26.0.0.0b3
- 26.0.0.0rc1
- 26.1.0
- 27.0.0
- 27.0.0.0b1
- 27.0.0.0b2
- 27.0.0.0rc1
- 27.1.0
- 27.1.1
- 28.0.0
- 28.0.0.0b2
- 28.0.0.0rc1
- 28.0.1
- Affected ranges
- ECOSYSTEM: ≤ 28.0.1
No fix published
nova PyPI
- Versions
- 15.1.5
- 16.1.6
- 16.1.7
- 16.1.8
- 17.0.10
- 17.0.11
- 17.0.12
- 17.0.13
- 17.0.7
- 17.0.8
- 17.0.9
- 18.0.2
- 18.0.3
- 18.1.0
- 18.2.0
- 18.2.1
- 18.2.2
- 18.2.3
- 18.3.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1.0
- 19.2.0
- 19.3.0
- 19.3.1
- 19.3.2
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.1.1
- 20.2.0
- 20.3.0
- 20.4.0
- 20.4.1
- 20.5.0
- 20.6.0
- 20.6.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 21.1.1
- 21.1.2
- 21.2.0
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.1.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.0.1
- 23.0.2
- 23.1.0
- 23.2.0
- 23.2.1
- 23.2.2
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- 24.1.0
- 24.1.1
- 24.2.0
- 24.2.1
- 25.0.0
- 25.0.0.0rc1
- 25.0.1
- 25.1.0
- 25.1.1
- 25.2.0
- 25.2.1
- 25.3.0
- 26.0.0
- 26.0.0.0rc1
- 26.0.0.0rc2
- 26.1.0
- 26.1.1
- 26.2.0
- 26.2.1
- 26.2.2
- 26.3.0
- 27.0.0
- 27.0.0.0rc1
- 27.1.0
- 27.2.0
- 27.3.0
- 27.4.0
- 27.5.0
- 27.5.1
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 28.1.0
- 28.2.0
- 28.3.0
- 28.3.1
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- 29.0.2
- Affected ranges
- ECOSYSTEM: ≤ 29.0.2
No fix published
glance Ubuntu:Pro:16.04:LTS
- Versions
- 2:11.0.0-0ubuntu1
- 2:12.0.0~b1-0ubuntu1
- 2:12.0.0~b2-0ubuntu1
- 2:12.0.0~b3-0ubuntu1
- 2:12.0.0~rc1-0ubuntu1
- 2:12.0.0-0ubuntu1
- 2:12.0.0-0ubuntu2
- Affected ranges
- ECOSYSTEM: < 2:12.0.0-0ubuntu2+esm1
Update to 2:12.0.0-0ubuntu2+esm1
cinder Ubuntu:16.04:LTS
- Versions
- 2:7.0.0-0ubuntu1
- 2:8.0.0~b1-0ubuntu1
- 2:8.0.0~b2-0ubuntu2
- 2:8.0.0~b3-0ubuntu2
- 2:8.0.0~rc1-0ubuntu2
- 2:8.0.0-0ubuntu1
- 2:8.1.0-0ubuntu1
- 2:8.1.1-0ubuntu1
- 2:8.1.1-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nova Ubuntu:Pro:16.04:LTS
- Versions
- 2:12.0.0-0ubuntu2
- 2:13.0.0~b1-0ubuntu1
- 2:13.0.0~b2-0ubuntu1
- 2:13.0.0~b3-0ubuntu1
- 2:13.0.0~rc1-0ubuntu1
- 2:13.0.0~rc3-0ubuntu1
- 2:13.0.0-0ubuntu1
- 2:13.0.0-0ubuntu2
- 2:13.0.0-0ubuntu5
- 2:13.1.0-0ubuntu1
- 2:13.1.1-0ubuntu1
- 2:13.1.1-0ubuntu1.1
- 2:13.1.2-0ubuntu2
- 2:13.1.3-0ubuntu1
- 2:13.1.3-0ubuntu2
- 2:13.1.4-0ubuntu1
- 2:13.1.4-0ubuntu2
- 2:13.1.4-0ubuntu3
- 2:13.1.4-0ubuntu4.1
- 2:13.1.4-0ubuntu4.2
- 2:13.1.4-0ubuntu4.3
- 2:13.1.4-0ubuntu4.4
- 2:13.1.4-0ubuntu4.5
- 2:13.1.4-0ubuntu4.5+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cinder Ubuntu:Pro:18.04:LTS
- Versions
- 2:11.0.0-0ubuntu2
- 2:11.0.0-0ubuntu3
- 2:12.0.0~b1-0ubuntu1
- 2:12.0.0~b2-0ubuntu2
- 2:12.0.0~rc1-0ubuntu1
- 2:12.0.0~rc2-0ubuntu1
- 2:12.0.0~rc2-0ubuntu2
- 2:12.0.0-0ubuntu1
- 2:12.0.1-0ubuntu1
- 2:12.0.3-0ubuntu1
- 2:12.0.4-0ubuntu1
- 2:12.0.5-0ubuntu1
- 2:12.0.7-0ubuntu2
- 2:12.0.9-0ubuntu1
- 2:12.0.9-0ubuntu1.2
- 2:12.0.10-0ubuntu1
- 2:12.0.10-0ubuntu2
- 2:12.0.10-0ubuntu2.2
- 2:12.0.10-0ubuntu2.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
glance Ubuntu:Pro:18.04:LTS
- Versions
- 2:15.0.0-0ubuntu1
- 2:16.0.0~b2-0ubuntu2
- 2:16.0.0~rc1-0ubuntu1
- 2:16.0.0~rc2-0ubuntu1
- 2:16.0.0~rc3-0ubuntu1
- 2:16.0.0-0ubuntu1
- 2:16.0.1-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 2:16.0.1-0ubuntu1.1+esm2
Update to 2:16.0.1-0ubuntu1.1+esm2
nova Ubuntu:Pro:18.04:LTS
- Versions
- 2:16.0.1-0ubuntu1
- 2:16.0.1-0ubuntu2
- 2:17.0.0~b1-0ubuntu1
- 2:17.0.0~b2-0ubuntu2
- 2:17.0.0~b3-0ubuntu3
- 2:17.0.0~b3-0ubuntu4
- 2:17.0.0~rc1-0ubuntu1
- 2:17.0.0~rc2-0ubuntu1
- 2:17.0.0~rc3-0ubuntu1
- 2:17.0.0-0ubuntu1
- 2:17.0.1-0ubuntu1
- 2:17.0.3-0ubuntu1
- 2:17.0.4-0ubuntu1
- 2:17.0.5-0ubuntu1
- 2:17.0.5-0ubuntu2
- 2:17.0.6-0ubuntu1
- 2:17.0.7-0ubuntu1
- 2:17.0.7-0ubuntu2
- 2:17.0.9-0ubuntu1
- 2:17.0.9-0ubuntu3
- 2:17.0.10-0ubuntu2
- 2:17.0.10-0ubuntu2.1
- 2:17.0.11-0ubuntu1
- 2:17.0.12-0ubuntu1
- 2:17.0.13-0ubuntu1
- 2:17.0.13-0ubuntu2
- 2:17.0.13-0ubuntu3
- 2:17.0.13-0ubuntu4
- 2:17.0.13-0ubuntu5
- 2:17.0.13-0ubuntu5.2
- 2:17.0.13-0ubuntu5.3
- 2:17.0.13-0ubuntu5.4
- 2:17.0.13-0ubuntu5.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cinder Ubuntu:20.04:LTS
- Versions
- 2:15.0.0-0ubuntu1
- 2:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu1
- 2:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu1
- 2:16.0.0~b3~git2020041012.eb915e2db-0ubuntu1
- 2:16.0.0-0ubuntu0.20.04.1
- 2:16.1.0-0ubuntu1
- 2:16.2.0-0ubuntu1
- 2:16.2.1-0ubuntu1
- 2:16.2.1-0ubuntu2
- 2:16.3.0-0ubuntu1
- 2:16.4.0-0ubuntu1
- 2:16.4.1-0ubuntu1
- 2:16.4.2-0ubuntu2
- 2:16.4.2-0ubuntu2.1
- 2:16.4.2-0ubuntu2.2
- 2:16.4.2-0ubuntu2.3
- 2:16.4.2-0ubuntu2.4
- 2:16.4.2-0ubuntu2.5
- 2:16.4.2-0ubuntu2.6
- Affected ranges
- ECOSYSTEM: < 2:16.4.2-0ubuntu2.8
Update to 2:16.4.2-0ubuntu2.8
glance Ubuntu:20.04:LTS
- Versions
- 2:19.0.0-0ubuntu1
- 2:20.0.0~b1~git2019121610.0c6dd98d-0ubuntu1
- 2:20.0.0~b2~git2020020509.8649fdc2-0ubuntu1
- 2:20.0.0~b3~git2020032414.30ece7aa-0ubuntu2
- 2:20.0.0~b3~git2020041012.d5a0ce18-0ubuntu1
- 2:20.0.0-0ubuntu0.20.04.1
- 2:20.0.1-0ubuntu1
- 2:20.1.0-0ubuntu1
- 2:20.2.0-0ubuntu1
- 2:20.2.0-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 2:20.2.0-0ubuntu1.2
Update to 2:20.2.0-0ubuntu1.2
nova Ubuntu:20.04:LTS
- Versions
- 2:20.0.0-0ubuntu1
- 2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5
- 2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2
- 2:21.0.0-0ubuntu0.20.04.1
- 2:21.0.0-0ubuntu0.20.04.2
- 2:21.1.0-0ubuntu1
- 2:21.1.1-0ubuntu2
- 2:21.1.2-0ubuntu1
- 2:21.2.0-0ubuntu1
- 2:21.2.1-0ubuntu1
- 2:21.2.2-0ubuntu1
- 2:21.2.3-0ubuntu1
- 2:21.2.4-0ubuntu1
- 2:21.2.4-0ubuntu2
- 2:21.2.4-0ubuntu2.1
- 2:21.2.4-0ubuntu2.2
- 2:21.2.4-0ubuntu2.3
- 2:21.2.4-0ubuntu2.4
- 2:21.2.4-0ubuntu2.5
- 2:21.2.4-0ubuntu2.6
- Affected ranges
- ECOSYSTEM: < 2:21.2.4-0ubuntu2.8
Update to 2:21.2.4-0ubuntu2.8
cinder Ubuntu:22.04:LTS
- Versions
- 2:19.0.0-0ubuntu2
- 2:19.0.0+git2022030310.b49fb59a6-0ubuntu1
- 2:19.0.0+git2022030310.b49fb59a6-0ubuntu2
- 2:20.0.0-0ubuntu1
- 2:20.0.1-0ubuntu1
- 2:20.1.0-0ubuntu1
- 2:20.1.0-0ubuntu2.1
- 2:20.1.0-0ubuntu2.2
- 2:20.2.0-0ubuntu1
- 2:20.2.0-0ubuntu1.1
- 2:20.3.0-0ubuntu1
- 2:20.3.1-0ubuntu1
- 2:20.3.1-0ubuntu1.1
- 2:20.3.1-0ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 2:20.3.1-0ubuntu1.4
Update to 2:20.3.1-0ubuntu1.4
glance Ubuntu:22.04:LTS
- Versions
- 2:23.0.0-0ubuntu1
- 2:23.0.0+git2021120811.4ee7799aa-0ubuntu1
- 2:23.0.0+git2022011216.502fa0ffc-0ubuntu1
- 2:24.0.0~rc1+git2022030311.d4119be05-0ubuntu1
- 2:24.0.0-0ubuntu1
- 2:24.1.0-0ubuntu1
- 2:24.1.0-0ubuntu1.1
- 2:24.2.0-0ubuntu1
- 2:24.2.1-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 2:24.2.1-0ubuntu1.2
Update to 2:24.2.1-0ubuntu1.2
Original sources
- https://launchpad.net/bugs/2059809
- http://www.openwall.com/lists/oss-security/2024/07/02/2
- https://www.openwall.com/lists/oss-security/2024/07/02/2
- https://security.openstack.org/ossa/OSSA-2024-001.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-32498