USN-6882-1: Cinder vulnerability
Published Jul 8, 2024
·Updated
Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.
Affected Software
8 affected componentsFixes available
All of the following
ubuntu/python3-cinder<2:24.0.0-0ubuntu1.2
2:24.0.0-0ubuntu1.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/python3-cinder<2:23.0.0-0ubuntu1.4
2:23.0.0-0ubuntu1.4
Ubuntu Ubuntu=23.10
All of the following
ubuntu/python3-cinder<2:20.3.1-0ubuntu1.4
2:20.3.1-0ubuntu1.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/python3-cinder<2:16.4.2-0ubuntu2.8
2:16.4.2-0ubuntu2.8
Ubuntu Ubuntu=20.04
Event History
Jul 8, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6882-1?
The severity of USN-6882-1 is considered high due to the potential for unauthorized access to sensitive files.
2
How do I fix USN-6882-1?
To fix USN-6882-1, upgrade to the specified patched version of python3-cinder for your Ubuntu distribution.
3
Which Ubuntu versions are affected by USN-6882-1?
The affected Ubuntu versions for USN-6882-1 include 24.04, 23.10, 22.04, and 20.04 with specific python3-cinder package versions.
4
What specific package is vulnerable in USN-6882-1?
The vulnerable package in USN-6882-1 is python3-cinder, which improperly handles QCOW2 image processing.
5
Who discovered the issue reported in USN-6882-1?
The issue reported in USN-6882-1 was discovered by Martin Kaesberger.