[openstack-announce] [OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1

Tristan Cacqueray tdecacqu at redhat.com
Wed Jun 17 14:43:59 UTC 2015


=======================================================================
OSSA-2015-011.1: Cinder host file disclosure through qcow2 backing file
=======================================================================

:Date: June 16, 2015
:CVE: CVE-2015-1851


Affects
~~~~~~~
- Cinder: versions through 2014.1.4,
          and 2014.2 versions through 2014.2.3,
          and version 2015.1.0


Description
~~~~~~~~~~~
Bastian Blank from credativ reported a vulnerability in Cinder. By
overwriting an image with a malicious qcow2 header, an authenticated
user may mislead Cinder upload-to-image action, resulting in
disclosure of any file from the Cinder server. All Cinder setups are
affected.


Errata
~~~~~~
CVE-2015-1850 has been assigned to a similar issue in Nova, the
correct CVE number for Cinder is CVE-2015-1851.


Patches
~~~~~~~
- https://review.openstack.org/191871 (Icehouse)
- https://review.openstack.org/191865 (Juno)
- https://review.openstack.org/191786 (Kilo)
- https://review.openstack.org/191785 (Liberty)


Credits
~~~~~~~
- Bastian Blank from Credativ (CVE-2015-1851)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1415087
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1851


Notes
~~~~~
- This fix will be included in future 2014.1.5 (icehouse), 2014.2.4
  (juno) and 2015.1.1 (kilo) releases.


OSSA History
~~~~~~~~~~~~
- 2015-06-17 - Errata 1
- 2015-06-16 - Original Version

--
Tristan Cacqueray
OpenStack Vulnerability Management Team

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20150617/c8ef9f30/attachment.pgp>


More information about the OpenStack-announce mailing list