An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1017 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1278 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1016 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1279 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1015 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1280 advisory.

  - openstack: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a0509648-65ce-4a1b-855e-520a75bd2549 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-5 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5835-4 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5338 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5336 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5337 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5835-1 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5835-3 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5835-2 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3301 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3302 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3300 advisory.

  - An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before     23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By     supplying a specially created VMDK flat image that references a specific backing file path, an     authenticated user may convince systems to return a copy of that file's contents from the server,     resulting in unauthorized access to potentially sensitive data. (CVE-2022-47951)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194330	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-glance) (RHSA-2023:1017)	Nessus	Red Hat Local Security Checks	medium
194293	RHEL 7 / 8 : Red Hat OpenStack Platform (openstack-nova) (RHSA-2023:1278)	Nessus	Red Hat Local Security Checks	medium
194290	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-cinder) (RHSA-2023:1016)	Nessus	Red Hat Local Security Checks	medium
194260	RHEL 7 / 8 : Synopsis: Red Hat OpenStack Platform (openstack-cinder) (RHSA-2023:1279)	Nessus	Red Hat Local Security Checks	medium
194249	RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-nova) (RHSA-2023:1015)	Nessus	Red Hat Local Security Checks	medium
194226	RHEL 7 / 8 : Synopsis: Red Hat OpenStack Platform (openstack-glance) (RHSA-2023:1280)	Nessus	Red Hat Local Security Checks	medium
174301	FreeBSD : py-cinder -- unauthorized data access (a0509648-65ce-4a1b-855e-520a75bd2549)	Nessus	FreeBSD Local Security Checks	medium
171251	Ubuntu 18.04 LTS : Nova vulnerability (USN-5835-5)	Nessus	Ubuntu Local Security Checks	medium
171250	Ubuntu 18.04 LTS / 20.04 LTS : Cinder vulnerability (USN-5835-4)	Nessus	Ubuntu Local Security Checks	medium
170952	Debian DSA-5338-1 : cinder - security update	Nessus	Debian Local Security Checks	medium
170942	Debian DSA-5336-1 : glance - security update	Nessus	Debian Local Security Checks	medium
170941	Debian DSA-5337-1 : nova - security update	Nessus	Debian Local Security Checks	medium
170910	Ubuntu 20.04 LTS / 22.04 LTS : Cinder vulnerability (USN-5835-1)	Nessus	Ubuntu Local Security Checks	medium
170908	Ubuntu 20.04 LTS / 22.04 LTS : Nova vulnerability (USN-5835-3)	Nessus	Ubuntu Local Security Checks	medium
170907	Ubuntu 20.04 LTS / 22.04 LTS : OpenStack Glance vulnerability (USN-5835-2)	Nessus	Ubuntu Local Security Checks	medium
170886	Debian DLA-3301-1 : cinder - LTS security update	Nessus	Debian Local Security Checks	medium
170883	Debian DLA-3302-1 : nova - LTS security update	Nessus	Debian Local Security Checks	medium
170882	Debian DLA-3300-1 : glance - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2022-47951

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium