Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:33:45 +0000 CVE-2024-32498 https://vulnerability.circl.lu/vuln/cve-2024-32498 <p>An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file&#39;s contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.</p> <p>An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file&#39;s contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.</p> https://vulnerability.circl.lu/vuln/cve-2024-32498 USN-6882-1 — cinder vulnerability https://vulnerability.circl.lu/vuln/usn-6882-1 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: cinder, Ubuntu:22.04:LTS: cinder, Ubuntu:24.04:LTS: cinder</p> <p>Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: cinder, Ubuntu:22.04:LTS: cinder, Ubuntu:24.04:LTS: cinder</p> <p>Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.</p> https://vulnerability.circl.lu/vuln/usn-6882-1