USN-6073-2: Glance_store vulnerability
Jan Wasilewski and Gorka Eguileor discovered that Glancestore incorrectly handled deleted volume attachments. An authenticated user or attacker could possibly use this issue to gain access to sensitive information. This update may require configuration changes to be completely effective, please see the upstream advisory for more information: https://security.openstack.org/ossa/OSSA-2023-003.html
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Glance_store vulnerability?
The vulnerability ID for this Glance_store vulnerability is USN-6073-2.
What is the impact of the Glance_store vulnerability?
An authenticated user or attacker could possibly use this vulnerability to gain access to sensitive information.
How can an authenticated user or attacker exploit this vulnerability?
An authenticated user or attacker can exploit this vulnerability by manipulating deleted volume attachments.
Which software versions are affected by this Glance_store vulnerability?
The Glance_store vulnerability affects the following software versions: Ubuntu 23.04, 22.10, 22.04, and 20.04.
How can I fix the Glance_store vulnerability?
To fix the Glance_store vulnerability, you need to update the python3-glance-store package to version 4.3.0-0ubuntu1.1 or later.