CVE-2024-32498 Affecting cinder package, versions <2:24.0.0-5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN13-CINDER-8383138
- published 17 Nov 2024
- disclosed 5 Jul 2024
Introduced: 5 Jul 2024
CVE-2024-32498 Open this link in a new tabHow to fix?
Upgrade Debian:13 cinder to version 2:24.0.0-5 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream cinder package and not the cinder package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.