GHSA-r4v4-w9pv-6fph

Suggest an improvement
Source
https://github.com/advisories/GHSA-r4v4-w9pv-6fph
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-r4v4-w9pv-6fph/GHSA-r4v4-w9pv-6fph.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r4v4-w9pv-6fph
Aliases
Published
2024-07-05T03:30:42Z
Modified
2025-11-04T20:44:41.871866Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
Details

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200",
        "CWE-552"
    ],
    "github_reviewed_at": "2024-07-08T19:04:07Z",
    "nvd_published_at": "2024-07-05T02:15:09Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / cinder

Package

Name
cinder
View open source insights on deps.dev
Purl
pkg:pypi/cinder

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
24.0.0

Affected versions

10.*

10.0.8

11.*

11.2.0
11.2.1
11.2.2

12.*

12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10

13.*

13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.0.6
13.0.7
13.0.8
13.0.9

14.*

14.0.0.0rc1
14.0.0.0rc2
14.0.0
14.0.1
14.0.2
14.0.3
14.0.4
14.1.0
14.2.0
14.2.1
14.3.0
14.3.1

15.*

15.0.0.0rc1
15.0.0.0rc2
15.0.0
15.0.1
15.1.0
15.2.0
15.3.0
15.4.0
15.4.1
15.5.0
15.6.0

16.*

16.0.0.0b1
16.0.0.0rc1
16.0.0.0rc2
16.0.0.0rc3
16.0.0
16.1.0
16.2.0
16.2.1
16.3.0
16.4.0
16.4.1
16.4.2

17.*

17.0.0.0rc1
17.0.0.0rc2
17.0.0
17.0.1
17.1.0
17.2.0
17.3.0
17.4.0

18.*

18.0.0.0b1
18.0.0.0rc1
18.0.0.0rc2
18.0.0
18.1.0
18.2.0
18.2.1

19.*

19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.0
19.1.0
19.1.1
19.2.0
19.3.0

20.*

20.0.0.0rc1
20.0.0.0rc2
20.0.0
20.0.1
20.1.0
20.2.0
20.3.0
20.3.1
20.3.2

21.*

21.0.0.0rc2
21.0.0
21.1.0
21.2.0
21.3.0
21.3.1
21.3.2

22.*

22.0.0.0rc1
22.0.0.0rc2
22.0.0
22.1.0
22.1.1
22.1.2
22.2.0
22.3.0

23.*

23.0.0.0rc1
23.0.0.0rc2
23.0.0
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0

24.*

24.0.0.0rc1
24.0.0.0rc2
24.0.0

PyPI / glance

Package

Name
glance
View open source insights on deps.dev
Purl
pkg:pypi/glance

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
28.0.1

Affected versions

15.*

15.0.2

17.*

17.0.1

18.*

18.0.0.0b1
18.0.0.0rc1
18.0.0
18.0.1

19.*

19.0.0.0b1
19.0.0.0rc1
19.0.0.0rc2
19.0.0
19.0.1
19.0.2
19.0.3
19.0.4

20.*

20.0.0.0b1
20.0.0.0b2
20.0.0.0b3
20.0.0.0rc1
20.0.0.0rc2
20.0.0
20.0.1
20.1.0
20.2.0

21.*

21.0.0.0b1
21.0.0.0b2
21.0.0.0rc1
21.0.0.0rc2
21.0.0
21.1.0

22.*

22.0.0.0b2
22.0.0.0b3
22.0.0.0rc1
22.0.0
22.1.0
22.1.1

23.*

23.0.0.0b2
23.0.0.0b3
23.0.0.0rc1
23.0.0.0rc2
23.0.0
23.1.0

24.*

24.0.0.0rc1
24.0.0
24.1.0
24.2.0
24.2.1

25.*

25.0.0.0b2
25.0.0.0b3
25.0.0.0rc1
25.0.0
25.1.0

26.*

26.0.0.0b2
26.0.0.0b3
26.0.0.0rc1
26.0.0
26.1.0

27.*

27.0.0.0b1
27.0.0.0b2
27.0.0.0rc1
27.0.0
27.1.0
27.1.1

28.*

28.0.0.0b2
28.0.0.0rc1
28.0.0
28.0.1

PyPI / nova

Package

Name
nova
View open source insights on deps.dev
Purl
pkg:pypi/nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
29.0.2

Affected versions

15.*

15.1.5

16.*

16.1.6
16.1.7
16.1.8

17.*

17.0.7
17.0.8
17.0.9
17.0.10
17.0.11
17.0.12
17.0.13

18.*

18.0.2
18.0.3
18.1.0
18.2.0
18.2.1
18.2.2
18.2.3
18.3.0

19.*

19.0.0.0rc1
19.0.0.0rc2
19.0.0
19.0.1
19.0.2
19.0.3
19.1.0
19.2.0
19.3.0
19.3.1
19.3.2

20.*

20.0.0.0rc1
20.0.0.0rc2
20.0.0
20.0.1
20.1.0
20.1.1
20.2.0
20.3.0
20.4.0
20.4.1
20.5.0
20.6.0
20.6.1

21.*

21.0.0.0rc1
21.0.0.0rc2
21.0.0
21.1.0
21.1.1
21.1.2
21.2.0
21.2.1
21.2.2
21.2.3
21.2.4

22.*

22.0.0.0rc1
22.0.0
22.0.1
22.1.0
22.2.0
22.2.1
22.2.2
22.3.0
22.4.0

23.*

23.0.0.0rc1
23.0.0.0rc2
23.0.0
23.0.1
23.0.2
23.1.0
23.2.0
23.2.1
23.2.2

24.*

24.0.0.0rc1
24.0.0.0rc2
24.0.0
24.1.0
24.1.1
24.2.0
24.2.1

25.*

25.0.0.0rc1
25.0.0
25.0.1
25.1.0
25.1.1
25.2.0
25.2.1
25.3.0

26.*

26.0.0.0rc1
26.0.0.0rc2
26.0.0
26.1.0
26.1.1
26.2.0
26.2.1
26.2.2
26.3.0

27.*

27.0.0.0rc1
27.0.0
27.1.0
27.2.0
27.3.0
27.4.0
27.5.0
27.5.1

28.*

28.0.0.0rc1
28.0.0
28.0.1
28.1.0
28.2.0
28.3.0
28.3.1

29.*

29.0.0.0rc1
29.0.0
29.0.1
29.0.2