GitHub Advisoryadvisory · PyPI

GHSA-9hcj-h2qc-689p OpenStack Cinder file disclosure in image convert

MEDIUM Published 2022-05-17 Modified 2024-05-14 Official page ↗
Aliases
CVE-2015-1851
Ecosystem
PyPI
Packages
cinder
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-05-14

Affected packages

• PyPI cinder: < 7.0.0a0 → fixed in 7.0.0a0

Description

OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.

Related

Alias · CVE (1)

  • CVE-2015-1851 OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References