GitHub Advisoryadvisory · PyPI

GHSA-r4v4-w9pv-6fph OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

HIGH Published 2024-07-05 Modified 2025-11-04 Official page ↗
Aliases
CVE-2024-32498
Ecosystem
PyPI
Packages
cinder, glance, nova
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-552
Reviewed
2024-07-08

Affected packages

• PyPI cinder: <= 24.0.0 (no fix yet) • PyPI glance: <= 28.0.1 (no fix yet) • PyPI nova: <= 29.0.2 (no fix yet)

Description

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Related

Alias · CVE (1)

  • CVE-2024-32498 An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-552 Files or Directories Accessible to External Parties weakness

References