USN-5835-1: Cinder vulnerability

Reference Links

• https://ubuntu.com/security/CVE-2022-47951
• https://ubuntu.com/security/notices/USN-5835-2
• https://ubuntu.com/security/notices/USN-5835-3
• https://ubuntu.com/security/notices/USN-5835-4
• https://ubuntu.com/security/notices/USN-5835-5
• https://ubuntu.com/security/notices/USN-6882-2
• https://launchpad.net/ubuntu/+source/cinder/2:21.1.0-0ubuntu1
• https://launchpad.net/ubuntu/+source/cinder/2:20.1.0-0ubuntu1
• https://launchpad.net/ubuntu/+source/cinder/2:16.4.2-0ubuntu2.1
• https://ubuntu.com/security/notices/USN-5835-1 (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2022-47951

Frequently Asked Questions

• What is the severity of USN-5835-1?

  USN-5835-1 is classified as a high severity vulnerability due to the potential for an authenticated attacker to access sensitive information.

• How do I fix USN-5835-1?

  To fix USN-5835-1, you should upgrade to the latest patched version of python3-cinder listed in the advisory for your Ubuntu version.

• What systems are affected by USN-5835-1?

  USN-5835-1 affects Ubuntu versions 22.10, 22.04, and 20.04 that have specific versions of python3-cinder installed.

• What is the nature of the vulnerability described in USN-5835-1?

  The vulnerability in USN-5835-1 involves improper handling of VMDK image processing which may lead to unauthorized file access.

• Who discovered the vulnerability referenced in USN-5835-1?

  The vulnerability in USN-5835-1 was discovered by researchers Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou.