CVE-2023-2088

Advisory

Nova 27.1.0, 26.2.0 and 25.2.0 include a fix for CVE-2023-2088: A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.
https://opendev.org/openstack/nova/commit/db455548a12beac1153ce04eca5e728d7b773901

Affected package

Affected versions

Fixed versions

Vulnerability changelog

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality. See CVE-2023-2088.


MISC:https://bugs.launchpad.net/bugs/2004555: https://bugs.launchpad.net/bugs/2004555

Resources

• https://bugs.launchpad.net/bugs/2004555
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2088
• https://security.openstack.org/ossa/OSSA-2023-003.html