NetSight
IP …
high6.5

CVE-2024-32498

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

Impact

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Affected packages

EcosystemPackageAffectedFixed in
pipcinder<= 24.0.0none recorded
pipglance<= 28.0.1none recorded
pipnova<= 29.0.2none recorded

Affected products

VendorProductAffected versions
OpenstackCinder
before 22.1.3
from 23.0.0 before 23.1.1
Version 24.0.0
OpenstackGlance
before 26.0.1
from 28.0.0 before 28.0.2
Version 27.0.0
OpenstackNova
before 27.3.1
from 28.0.0 before 28.1.1
from 29.0.0 before 29.0.3

Weakness classification

CWE-552CWE-200

References