CVE-2024-32498

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-32498
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32498.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32498
Aliases
Related
Published
2024-07-05T02:15:09Z
Modified
2024-09-23T16:45:22.206831Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

References

Affected packages

Debian:11 / cinder

Package

Name
cinder
Purl
pkg:deb/debian/cinder?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:17.4.0-1~deb11u2

Affected versions

2:17.*

2:17.0.1-1
2:17.0.1-1+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / cinder

Package

Name
cinder
Purl
pkg:deb/debian/cinder?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:21.3.1-1~deb12u1

Affected versions

2:21.*

2:21.1.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / glance

Package

Name
glance
Purl
pkg:deb/debian/glance?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:21.1.0-1+deb11u2

Affected versions

2:21.*

2:21.0.0-2
2:21.0.0-2+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / glance

Package

Name
glance
Purl
pkg:deb/debian/glance?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:25.1.0-2+deb12u1

Affected versions

2:25.*

2:25.1.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / glance

Package

Name
glance
Purl
pkg:deb/debian/glance?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:28.0.1-3+deb12u1

Affected versions

2:25.*

2:25.1.0-2

2:26.*

2:26.0.0~rc1-1
2:26.0.0-1
2:26.0.0-2
2:26.0.0-3
2:26.0.0-4

2:27.*

2:27.0.0~rc1-1
2:27.0.0-1
2:27.0.0-2

2:28.*

2:28.0.0~rc1-1
2:28.0.1-1
2:28.0.1-2
2:28.0.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / nova

Package

Name
nova
Purl
pkg:deb/debian/nova?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:22.4.0-1~deb11u5

Affected versions

2:22.*

2:22.0.1-2
2:22.0.1-2+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / nova

Package

Name
nova
Purl
pkg:deb/debian/nova?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:26.2.2-1~deb12u3

Affected versions

2:26.*

2:26.1.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / nova

Package

Name
nova
Purl
pkg:deb/debian/nova?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:29.0.2-4

Affected versions

2:26.*

2:26.1.0-4
2:26.2.2-1~deb12u3

2:27.*

2:27.0.0~rc1-1
2:27.0.0-1
2:27.0.0-2
2:27.0.0-3
2:27.0.0-4
2:27.0.0-5
2:27.0.0-6

2:28.*

2:28.0.0~rc1-1
2:28.0.0-1
2:28.0.0-2

2:29.*

2:29.0.0~rc1-1
2:29.0.1-1
2:29.0.1-2
2:29.0.1-3
2:29.0.1-4
2:29.0.1-5
2:29.0.1-6
2:29.0.2-1
2:29.0.2-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}