Headline
Red Hat Security Advisory 2024-4273-03
Red Hat Security Advisory 2024-4273-03 - An update for openstack-cinder, openstack-glance, and openstack-nova is now available for Red Hat OpenStack Platform 16.2.
The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_4273.jsonRed Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis: Critical: Red Hat OpenStack Platform 16.2.6 security updateAdvisory ID: RHSA-2024:4273-03Product: Red Hat OpenStack PlatformAdvisory URL: https://access.redhat.com/errata/RHSA-2024:4273Issue date: 2024-07-02Revision: 03CVE Names: CVE-2024-32498====================================================================Summary: An update for openstack-cinder, openstack-glance, and openstack-nova is nowavailable for Red Hat OpenStack Platform 16.2 (Train).Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:Cinder is the replacement of nova-volume in Folsom and beyond, use d forblock storage.OpenStack Image Service (code-named Glance) providesdiscovery,registration, and delivery services for virtual disk images. TheImage Service API server provides a standard REST interface for queryinginformation about virtual disk images stored in a variety of back-endstores, including OpenStack Object Storage. Clients can register newvirtual disk images with the Image Service, query for information onpublicly available disk images, and use the Image Service's client libraryfor streaming virtual disk images.OpenStack Compute (codename Nova) is open source software designedto provision and manage large networks of virtual machines,creating aredundant and scalable cloud computing platform. It gives you the software,control panels, and APIs required to orchestrate a cloud, including runninginstances, managing networks, and controlling access through users andprojects.OpenStack Compute strives to be both hardware and hypervisoragnostic, currently supporting a variety of standard hardwareconfigurations and seven major hypervisors.Security Fix(es):* CVE-2024-32498 OpenStack: malicious qcow2/vmdk images(CVE-2024-32498)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-32498References:https://access.redhat.com/security/updates/classification/#criticalhttps://bugzilla.redhat.com/show_bug.cgi?id=2278663Related news
Ubuntu Security Notice 6882-2 - USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem. Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
Debian Linux Security Advisory 5756-1 - Martin Kaesberger discovered a vulnerability which affects multiple images may result in the disclosure of arbitrary files.
Debian Linux Security Advisory 5755-1 - Martin Kaesberger discovered a vulnerability which affects multiple images may result in the disclosure of arbitrary files.
Debian Linux Security Advisory 5754-1 - Martin Kaesberger discovered a vulnerability which affects multiple images may result in the disclosure of arbitrary files.
Red Hat Security Advisory 2024-4425-03 - An update for openstack-cinder, openstack-glance, and openstack-nova is now available for Red Hat OpenStack Platform 16.1.
Ubuntu Security Notice 6884-1 - Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
Ubuntu Security Notice 6883-1 - Martin Kaesberger discovered that Glance incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
Ubuntu Security Notice 6882-1 - Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
Red Hat Security Advisory 2024-4274-03 - An update for openstack-nova is now available for Red Hat OpenStack Platform 17.1.