CVE-2024-32498

Advisory

A security flaw in affected versions of OpenStack Cinder allows arbitrary file access via custom QCOW2 external data. An authenticated user can supply a crafted QCOW2 image that references a specific data file path, convincing systems to return a copy of that file's contents from the server. This results in unauthorized access to potentially sensitive data.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r4v4-w9pv-6fph
• https://github.com/openstack/cinder/commit/78f85c1f9b20a067ef64d6451dee0228c3a0db5e
• https://bugs.launchpad.net/cinder/+bug/2059809
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32498