Vulnerability Description
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Cinder | <= 19.1.2 |
| Openstack | Glance | < 23.0.1 |
| Openstack | Nova | < 24.1.2 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://launchpad.net/bugs/1996188ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00040.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00041.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00042.htmlMailing ListThird Party Advisory
- https://security.openstack.org/ossa/OSSA-2023-002.htmlPatchVendor Advisory
- https://www.debian.org/security/2023/dsa-5336Third Party Advisory
- https://www.debian.org/security/2023/dsa-5337Third Party Advisory
- https://www.debian.org/security/2023/dsa-5338Third Party Advisory
- https://launchpad.net/bugs/1996188ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2023/01/msg00040.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00041.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00042.htmlMailing ListThird Party Advisory
- https://security.openstack.org/ossa/OSSA-2023-002.htmlPatchVendor Advisory
- https://www.debian.org/security/2023/dsa-5336Third Party Advisory
- https://www.debian.org/security/2023/dsa-5337Third Party Advisory
FAQ
What is CVE-2022-47951?
CVE-2022-47951 is a vulnerability with a CVSS score of 5.7 (MEDIUM). An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0....
How severe is CVE-2022-47951?
CVE-2022-47951 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-47951?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Cinder, Openstack Glance, Openstack Nova, Debian Debian Linux.