An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6882-2 advisory.

    USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to     incorrect privilege handling. This update fixes the problem.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1017 advisory.

    OpenStack Image Service (code-named Glance) provides     discovery,registration, and delivery services for virtual disk images. The     Image Service API server provides a standard REST interface for querying     information about virtual disk images stored in a variety of back-end     stores, including OpenStack Object Storage. Clients can register new     virtual disk images with the Image Service, query for information on     publicly available disk images, and use the Image Service's client library     for streaming virtual disk images.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1278 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines, creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1016 advisory.

    Cinder is the replacement of nova-volume in Folsom and beyond, used for     block storage.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1279 advisory.

    Cinder is the replacement of nova-volume in Folsom and beyond, used for     block storage.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1015 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1280 advisory.

    OpenStack Image Service (code-named Glance) provides     discovery, registration, and delivery services for virtual disk images. The     Image Service API server provides a standard REST interface for querying     information about virtual disk images stored in a variety of back-end     stores, including OpenStack Object Storage. Clients can register new     virtual disk images with the Image Service, query for information on     publicly available disk images, and use the Image Service's client library     for streaming virtual disk images.

    Security Fix(es):

    * Arbitrary file access through custom VMDK flat descriptor     (CVE-2022-47951)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a0509648-65ce-4a1b-855e-520a75bd2549 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-5 advisory.

    USN-5835-3 fixed vulnerabilities in Nova. This update provides the corresponding updates for Ubuntu 18.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-4 advisory.

    USN-5835-1 fixed vulnerabilities in Cinder. This update provides the corresponding updates for Ubuntu     18.04 LTS. In addition, a regression was fixed for Ubuntu 20.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5338 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5336 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5337 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-1 advisory.

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Cinder incorrectly     handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK     flat image and obtain arbitrary files from the server containing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-3 advisory.

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Nova incorrectly handled     VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image     and obtain arbitrary files from the server containing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-2 advisory.

    Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that OpenStack Glance     incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially     crafted VMDK flat image and obtain arbitrary files from the server containing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3301 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3302 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3300 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210532	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Cinder regression (USN-6882-2)	Nessus	Ubuntu Local Security Checks	medium
194330	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-glance) (RHSA-2023:1017)	Nessus	Red Hat Local Security Checks	medium
194293	RHEL 7 / 8 : Red Hat OpenStack Platform (openstack-nova) (RHSA-2023:1278)	Nessus	Red Hat Local Security Checks	medium
194290	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-cinder) (RHSA-2023:1016)	Nessus	Red Hat Local Security Checks	medium
194260	RHEL 7 / 8 : Synopsis: Red Hat OpenStack Platform (openstack-cinder) (RHSA-2023:1279)	Nessus	Red Hat Local Security Checks	medium
194249	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-nova) (RHSA-2023:1015)	Nessus	Red Hat Local Security Checks	medium
194226	RHEL 7 / 8 : Synopsis: Red Hat OpenStack Platform (openstack-glance) (RHSA-2023:1280)	Nessus	Red Hat Local Security Checks	medium
174301	FreeBSD : py-cinder -- unauthorized data access (a0509648-65ce-4a1b-855e-520a75bd2549)	Nessus	FreeBSD Local Security Checks	medium
171251	Ubuntu 18.04 LTS : Nova vulnerability (USN-5835-5)	Nessus	Ubuntu Local Security Checks	medium
171250	Ubuntu 18.04 LTS / 20.04 LTS : Cinder vulnerability (USN-5835-4)	Nessus	Ubuntu Local Security Checks	medium
170952	Debian DSA-5338-1 : cinder - security update	Nessus	Debian Local Security Checks	medium
170942	Debian DSA-5336-1 : glance - security update	Nessus	Debian Local Security Checks	medium
170941	Debian DSA-5337-1 : nova - security update	Nessus	Debian Local Security Checks	medium
170910	Ubuntu 20.04 LTS / 22.04 LTS : Cinder vulnerability (USN-5835-1)	Nessus	Ubuntu Local Security Checks	medium
170908	Ubuntu 20.04 LTS / 22.04 LTS : Nova vulnerability (USN-5835-3)	Nessus	Ubuntu Local Security Checks	medium
170907	Ubuntu 20.04 LTS / 22.04 LTS : OpenStack Glance vulnerability (USN-5835-2)	Nessus	Ubuntu Local Security Checks	medium
170886	Debian DLA-3301-1 : cinder - LTS security update	Nessus	Debian Local Security Checks	medium
170883	Debian DLA-3302-1 : nova - LTS security update	Nessus	Debian Local Security Checks	medium
170882	Debian DLA-3300-1 : glance - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-47951

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium