Date: Tue, 16 Jun 2015 10:41:59 -0700 From: Tristan Cacqueray <tdecacqu@...hat.com> To: oss-security@...ts.openwall.com Subject: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850) ===================================================================== OSSA-2015-011: Cinder host file disclosure through qcow2 backing file ===================================================================== :Date: June 16, 2015 :CVE: CVE-2015-1850 Affects ~~~~~~~ - Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description ~~~~~~~~~~~ Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected. Patches ~~~~~~~ - https://review.openstack.org/191871 (Icehouse) - https://review.openstack.org/191865 (Juno) - https://review.openstack.org/191786 (Kilo) - https://review.openstack.org/191785 (Liberty) Credits ~~~~~~~ - Bastian Blank from Credativ (CVE-2015-1850) References ~~~~~~~~~~ - https://launchpad.net/bugs/1415087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1850 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.