OSSA-2015-011: Cinder host file disclosure through qcow2 backing file

OSSA-2015-011: Cinder host file disclosure through qcow2 backing file

Date:June 16, 2015
CVE:CVE-2015-1851

Affects

  • Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0

Description

Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected.

Errata

CVE-2015-1850 has been assigned to a similar issue in Nova, the correct CVE number for Cinder is CVE-2015-1851

Credits

  • Bastian Blank from Credativ (CVE-2015-1851)

Notes

  • This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases.

OSSA History

  • 2015-06-17 - Errata 1
  • 2015-06-16 - Original Version
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.