CVE-2024-32498

MEDIUM6.5EPSS 0.21%

nova - security update

發布日:2024/7/5修改日:2026/4/28

描述

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

受影響套件(11)

Debian/cinderfrom 0, < 2:21.3.1-1~deb12u1
Debian/cinderfrom 0, < 2:17.4.0-1~deb11u2
Debian/glancefrom 0, < 2:25.1.0-2+deb12u1
Debian/glancefrom 0, < 2:21.1.0-1+deb11u2
Debian/glancefrom 0, < 2:21.1.0-1+deb11u2
Debian/novafrom 0, < 2:26.2.2-1~deb12u3
Debian/novafrom 0, < 2:22.4.0-1~deb11u5
Debian/novafrom 0, < 2:22.4.0-1~deb11u5
PyPI/cinderfrom 0, <= 24.0.0
PyPI/glancefrom 0, <= 28.0.1
PyPI/novafrom 0, <= 29.0.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

描述

受影響套件(11)

CVSS 分數

參考連結(16)