Medium severity · published Jul 5, 2024
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cinder · Openstack
before 22.1.3; 23.0.0 before 23.1.1; 24.0.0 · source: NVD
GL
Glance · Openstack
before 26.0.1; 28.0.0 before 28.0.2; 27.0.0 · source: NVD
NO
Nova · Openstack
before 27.3.1; 28.0.0 before 28.1.1; 29.0.0 before 29.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-32498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-32498
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/02/2
Issue Tracking
https://launchpad.net/bugs/2059809
security.openstack.org
https://security.openstack.org/ossa/OSSA-2024-001.html
Mailing List
https://www.openwall.com/lists/oss-security/2024/07/02/2
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html
More from Cinder
7.5
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data
7.5
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
5.7
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x…
4.3
CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
–
CVE-2014-7231
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when…