CVE-2022-47951 OpenStack Cinder, glance, and Nova vulnerable to Path Traversal
An authenticated user can read arbitrary files from the server by uploading a malicious VMDK image in OpenStack Cinder, Glance, or Nova.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-47951?
CVE-2022-47951 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 26 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Weakness: CWE-22
Which versions are affected by CVE-2022-47951?
15 open source packages ship an affected version, including cinder, glance and nova. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
cinder PyPI | All versions | 19.1.2, 20.0.2 |
cinder PyPI | All versions | 19.1.2 |
cinder PyPI | All versions | 19.1.2 |
cinder PyPI | From 20.0.0 | 20.0.2 |
cinder PyPI | From 20.0.0 | 20.0.2 |
glance PyPI | All versions | 23.0.1, 24.1.1 |
9 more packages
glance PyPI | All versions | 23.0.1 |
glance PyPI | All versions | 23.0.1 |
glance PyPI | From 24.0.0 | 24.1.1 |
glance PyPI | From 24.0.0 | 24.1.1 |
nova PyPI | All versions | 24.1.2, 25.0.2 |
nova PyPI | All versions | 24.1.2 |
nova PyPI | All versions | 24.1.2 |
nova PyPI | From 25.0.0 | 25.0.2 |
nova PyPI | From 25.0.0 | 25.0.2 |
Linux distribution packages (25)
openstack-cinder Red Hat:openstack:13::el7 | All versions | 1:12.0.10-27.el7ost |
openstack-glance Red Hat:openstack:13::el7 | All versions | 1:16.0.1-13.el7ost |
openstack-nova Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-api Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-cells Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-common Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-compute Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-conductor Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-console Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-migration Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-network Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-novncproxy Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-placement-api Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-scheduler Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-serialproxy Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-nova-spicehtml5proxy Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
python-cinder Red Hat:openstack:13::el7 | All versions | 1:12.0.10-27.el7ost |
python-glance Red Hat:openstack:13::el7 | All versions | 1:16.0.1-13.el7ost |
python-glance-tests Red Hat:openstack:13::el7 | All versions | 1:16.0.1-13.el7ost |
python-nova Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
python-nova-tests Red Hat:openstack:13::el7 | All versions | 1:17.0.13-40.el7ost |
openstack-cinder Red Hat:openstack:16.1::el8 | All versions | 1:15.4.0-1.20230206163350.58f0e73.el8ost |
openstack-glance Red Hat:openstack:16.1::el8 | All versions | 1:19.0.4-1.20230207203320.5bbd356.el8ost |
openstack-nova Red Hat:openstack:16.1::el8 | All versions | 1:20.4.1-1.20221005193231.1ee93b9.el8ost |
openstack-nova-api Red Hat:openstack:16.1::el8 | All versions | 1:20.4.1-1.20221005193231.1ee93b9.el8ost |
Products include Debian Debian Linux, Openstack Cinder, Openstack Glance, Openstack Nova.
How do I fix CVE-2022-47951?
Upgrade cinder to a fixed version for your release line: 19.1.2 or 20.0.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-47951 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-47951 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-47951, DLA-3300-1, DLA-3301-1, DLA-3302-1, DSA-5336-1, DSA-5337-1 and 19 more.