CVE-2015-1851
Fixed in a distro release EPSS 3%
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Products: canonical ubuntu_linux, openstack icehouse, openstack juno, openstack kilo
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cinder | 7.0.0a0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 |
| Debian 13 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 |
| Debian 14 | cinder | 2015.1.0+2015.06.16.git26.9634b76ba5-1 |
| Debian 8 | cinder | 2014.1.3-11+deb8u1 |
| Red Hat openstack 5 | openstack-cinder | 0:2014.1.4-1.1.el6ost |
| Red Hat openstack 5 | openstack-cinder | 0:2014.1.4-1.1.el7ost |
| Red Hat openstack 5 | openstack-cinder-doc | 0:2014.1.4-1.1.el7ost |
| Red Hat openstack 5 | openstack-cinder-doc | 0:2014.1.4-1.1.el6ost |
| Red Hat openstack 5 | python-cinder | 0:2014.1.4-1.1.el6ost |
| Red Hat openstack 5 | python-cinder | 0:2014.1.4-1.1.el7ost |
| Red Hat openstack 6 | openstack-cinder | 0:2014.2.3-3.1.el7ost |
| Red Hat openstack 6 | openstack-cinder-doc | 0:2014.2.3-3.1.el7ost |
| Red Hat openstack 6 | python-cinder | 0:2014.2.3-3.1.el7ost |