DSA-5338: -1 cinder -- security update
Published Feb 1, 2023
·Updated
cinder - security update
Other sources
Guillaume Espanel, Pierre Libeau, Arnaud Morin and Damien Rannou discovered that missing input sanitising in the handling of VMDK images in Cinder, the OpenStack block storage system, may result in information disclosure.
Affected Software
2 affected components
debian/cinder
debian/cinder
Event History
Feb 1, 2023
Advisory Published
12:00 AM
Frequently Asked Questions
1
What condition is required for exploitation?
The issue is triggered through handling VMDK images by Cinder. An attacker would need a way to supply or cause Cinder to process a crafted VMDK image.
2
What is the impact of successful exploitation?
Successful exploitation may disclose information due to missing input sanitisation in Cinder's VMDK image handling.