An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.
    Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that     references a specific data file path, an authenticated user may convince systems to return a copy of that     file's contents from the server, resulting in unauthorized access to potentially sensitive data. All     Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are     affected. (CVE-2024-32498)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6882-2 advisory.

    USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to     incorrect privilege handling. This update fixes the problem.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3870 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3870-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 05, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-oslo.utils     Version        : 4.6.1-0+deb11u1

    python-oslo.utils, a set of utilities used by OpenStack, was updated     as a requirement to fix CVE-2024-32498 in the cinder, glance and     nova OpenStack components.

    For Debian 11 bullseye, this was addressed in version 4.6.1-0+deb11u1.

    We recommend that you upgrade your python-oslo.utils packages.

    For the detailed security status of python-oslo.utils please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-oslo.utils

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3871 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3871-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 05, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cinder     Version        : 2:17.4.0-1~deb11u2     CVE ID         : CVE-2023-2088 CVE-2024-32498     Debian Bug     : 1035961 1074763

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    This update also fixes unauthorized volume access through deleted     volume attachments (only Cinder deployments using the LVM over iSCSI     driver were affected).

    For Debian 11 bullseye, these problems have been fixed in version     2:17.4.0-1~deb11u2.

    We recommend that you upgrade your cinder packages.

    For the detailed security status of cinder please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cinder

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3873 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3873-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 05, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nova     Version        : 2:22.4.0-1~deb11u5     CVE ID         : CVE-2024-32498 CVE-2024-40767     Debian Bug     : 1074762

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    Arnaud Morin later discovered that the initial fix was not sufficient,     and that nova was still vulnerable with some VM images types.

    For Debian 11 bullseye, these problems have been fixed in version     2:22.4.0-1~deb11u5.

    We recommend that you upgrade your nova packages.

    For the detailed security status of nova please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nova

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3872 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3872-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 05, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : glance     Version        : 2:21.1.0-1+deb11u2     CVE ID         : CVE-2024-32498     Debian Bug     : 1074761

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    For Debian 11 bullseye, this problem has been fixed in version     2:21.1.0-1+deb11u2.

    We recommend that you upgrade your glance packages.

    For the detailed security status of glance please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glance

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5755 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5755-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 21, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : glance     CVE ID         : CVE-2024-32498

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    For the stable distribution (bookworm), this problem has been fixed in     version 2:25.1.0-2+deb12u1.

    We recommend that you upgrade your glance packages.

    For the detailed security status of glance please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glance

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5756 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5756-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 21, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nova     CVE ID         : CVE-2024-32498

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    For the stable distribution (bookworm), this problem has been fixed in     version 2:26.2.2-1~deb12u3.

    We recommend that you upgrade your nova packages.

    For the detailed security status of nova please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nova

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5754 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5754-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 21, 2024                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cinder     CVE ID         : CVE-2024-32498

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    For the stable distribution (bookworm), this problem has been fixed in     version 2:21.3.1-1~deb12u1.

    We recommend that you upgrade your cinder packages.

    For the detailed security status of cinder please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cinder

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4425 advisory.

    Cinder is the replacement of nova-volume in Folsom and beyond, use d for     block storage.

    OpenStack Image Service (code-named Glance) provides     discovery,registration, and delivery services for virtual disk images. The     Image Service API server provides a standard REST interface for querying     information about virtual disk images stored in a variety of back-end     stores, including OpenStack Object Storage. Clients can register new     virtual disk images with the Image Service, query for information on     publicly available disk images, and use the Image Service's client library     for streaming virtual disk images.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * malicious qcow2/vmdk images (2024-emu CVE-2024-32498)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6884-1 advisory.

    Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image processing. An authenticated user     could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6882-1 advisory.

    Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user     could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6883-1 advisory.

    Martin Kaesberger discovered that Glance incorrectly handled QCOW2 image processing. An authenticated user     could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4274 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * CVE-2024-32498 OpenStack: malicious qcow2/vmdk images     (CVE-2024-32498)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4272 advisory.

    Cinder is the replacement of nova-volume in Folsom and beyond, use d for     block storage.

    OpenStack Image Service (code-named Glance) provides     discovery,registration, and delivery services for virtual disk images. The     Image Service API server provides a standard REST interface for querying     information about virtual disk images stored in a variety of back-end     stores, including OpenStack Object Storage. Clients can register new     virtual disk images with the Image Service, query for information on     publicly available disk images, and use the Image Service's client library     for streaming virtual disk images.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * CVE-2024-32498 OpenStack: malicious qcow2/vmdk images     (CVE-2024-32498)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4273 advisory.

    Cinder is the replacement of nova-volume in Folsom and beyond, use d for     block storage.

    OpenStack Image Service (code-named Glance) provides     discovery,registration, and delivery services for virtual disk images. The     Image Service API server provides a standard REST interface for querying     information about virtual disk images stored in a variety of back-end     stores, including OpenStack Object Storage. Clients can register new     virtual disk images with the Image Service, query for information on     publicly available disk images, and use the Image Service's client library     for streaming virtual disk images.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * CVE-2024-32498 OpenStack: malicious qcow2/vmdk images     (CVE-2024-32498)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255867	Linux Distros Unpatched Vulnerability : CVE-2024-32498	Nessus	Misc.	medium
210532	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Cinder regression (USN-6882-2)	Nessus	Ubuntu Local Security Checks	medium
206643	Debian dla-3870 : python-oslo.utils-doc - security update	Nessus	Debian Local Security Checks	medium
206642	Debian dla-3871 : cinder-api - security update	Nessus	Debian Local Security Checks	medium
206639	Debian dla-3873 : nova-api - security update	Nessus	Debian Local Security Checks	medium
206638	Debian dla-3872 : glance - security update	Nessus	Debian Local Security Checks	medium
206013	Debian dsa-5755 : glance - security update	Nessus	Debian Local Security Checks	medium
206012	Debian dsa-5756 : nova-api - security update	Nessus	Debian Local Security Checks	medium
206011	Debian dsa-5754 : cinder-api - security update	Nessus	Debian Local Security Checks	medium
202074	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (RHSA-2024:4425)	Nessus	Red Hat Local Security Checks	medium
201952	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : Nova vulnerability (USN-6884-1)	Nessus	Ubuntu Local Security Checks	medium
201951	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : Cinder vulnerability (USN-6882-1)	Nessus	Ubuntu Local Security Checks	medium
201948	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : OpenStack Glance vulnerability (USN-6883-1)	Nessus	Ubuntu Local Security Checks	medium
201287	RHEL 8 : Red Hat OpenStack Platform 17.1.3 (openstack-nova) (RHSA-2024:4274)	Nessus	Red Hat Local Security Checks	medium
201279	RHEL 9 : Red Hat OpenStack Platform 17.1.3 (RHSA-2024:4272)	Nessus	Red Hat Local Security Checks	medium
201277	RHEL 8 : Red Hat OpenStack Platform 16.2.6 (RHSA-2024:4273)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2024-32498

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium