CVE-2022-47951
Summary
| CVE | CVE-2022-47951 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-01-26 22:15:00 UTC |
|---|
| Updated | 2023-02-06 17:27:00 UTC |
|---|
| Description | An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] [DLA 3300-1] glance security update |
MLIST |
lists.debian.org |
|
| Debian -- Security Information -- DSA-5338-1 cinder |
DEBIAN |
www.debian.org |
|
| Bug #1996188 “[OSSA-2023-002] Arbitrary file access through cust...” : Bugs : OpenStack Compute (nova) |
MISC |
launchpad.net |
|
| Debian -- Security Information -- DSA-5337-1 nova |
DEBIAN |
www.debian.org |
|
| [SECURITY] [DLA 3302-1] nova security update |
MLIST |
lists.debian.org |
|
| OSSA-2023-002: Arbitrary file access through custom VMDK flat descriptor — OpenStack Security Advisories 0.0.1.dev260 documentation |
CONFIRM |
security.openstack.org |
|
| Debian -- Security Information -- DSA-5336-1 glance |
DEBIAN |
www.debian.org |
|
| [SECURITY] [DLA 3301-1] cinder security update |
MLIST |
lists.debian.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181521 Debian Security Update for cinder (DLA 3301-1)
- 181528 Debian Security Update for glance (DLA 3300-1)
- 181529 Debian Security Update for nova (DLA 3302-1)
- 181536 Debian Security Update for nova (DSA 5337-1)
- 181537 Debian Security Update for glance (DSA 5336-1)
- 181538 Debian Security Update for cinder (DSA 5338-1)
- 184088 Debian Security Update for novaglancecinder (CVE-2022-47951)
- 199140 Ubuntu Security Notification for Nova Vulnerability (USN-5835-3)
- 199141 Ubuntu Security Notification for OpenStack Glance Vulnerability (USN-5835-2)
- 199142 Ubuntu Security Notification for Cinder Vulnerability (USN-5835-1)
- 199162 Ubuntu Security Notification for Nova Vulnerability (USN-5835-5)
- 199163 Ubuntu Security Notification for Cinder Vulnerability (USN-5835-4)
- 241231 Red Hat Update for OpenStack Platform 17.0 (RHSA-2023:1015)
- 241232 Red Hat Update for OpenStack Platform 17.0 (RHSA-2023:1016)
- 241235 Red Hat Update for OpenStack Platform 17.0 (RHSA-2023:1017)
- 241264 Red Hat Update for multiple OpenStack Platforms (RHSA-2023:1279)
- 241265 Red Hat Update for multiple OpenStack Platforms (RHSA-2023:1278)
- 241270 Red Hat Update for multiple OpenStack Platforms (RHSA-2023:1280)
- 691112 Free Berkeley Software Distribution (FreeBSD) Security Update for py (a0509648-65ce-4a1b-855e-520a75bd2549)
