CVE-2024-32498

Name	CVE-2024-32498
Description	An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3871-1, DLA-3872-1, DLA-3873-1, DSA-5754-1, DSA-5755-1, DSA-5756-1
Debian Bugs	1074761, 1074762, 1074763

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cinder (PTS)	jessie, jessie (lts)	2014.1.3-11+deb8u1	vulnerable
	stretch	2:9.0.0-4	vulnerable
	buster (security), buster, buster (lts)	2:13.0.7-1+deb10u2	vulnerable
	bullseye	2:17.0.1-1+deb11u1	vulnerable
	bullseye (security)	2:17.4.0-1~deb11u2	fixed
	bookworm (security), bookworm	2:21.3.1-1~deb12u1	fixed
	trixie	2:25.0.0-2	fixed
	sid	2:25.0.0-3	fixed
glance (PTS)	jessie	2014.1.3-12+deb8u1	vulnerable
	stretch	2:13.0.0-4	vulnerable
	buster (security), buster, buster (lts)	2:17.0.0-5+deb10u1	vulnerable
	bullseye	2:21.0.0-2+deb11u1	vulnerable
	bullseye (security)	2:21.1.0-1+deb11u2	fixed
	bookworm (security), bookworm	2:25.1.0-2+deb12u1	fixed
	sid, trixie	2:29.0.0-3	fixed
nova (PTS)	jessie	2014.1.3-11	vulnerable
	stretch (security), stretch (lts), stretch	2:14.0.0-4+deb9u1	vulnerable
	buster (security), buster, buster (lts)	2:18.1.0-6+deb10u2	vulnerable
	bullseye	2:22.0.1-2+deb11u1	vulnerable
	bullseye (security)	2:22.4.0-1~deb11u5	fixed
	bookworm (security), bookworm	2:26.2.2-1~deb12u3	fixed
	trixie	2:30.0.0-3	fixed
	sid	2:30.0.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cinder	source	jessie	(unfixed)	end-of-life
cinder	source	stretch	(unfixed)	end-of-life
cinder	source	buster	(unfixed)	end-of-life
cinder	source	bullseye	2:17.4.0-1~deb11u2		DLA-3871-1
cinder	source	bookworm	2:21.3.1-1~deb12u1		DSA-5754-1
cinder	source	(unstable)	2:24.0.0-5			1074763
glance	source	jessie	(unfixed)	end-of-life
glance	source	stretch	(unfixed)	end-of-life
glance	source	buster	(unfixed)	end-of-life
glance	source	bullseye	2:21.1.0-1+deb11u2		DLA-3872-1
glance	source	bookworm	2:25.1.0-2+deb12u1		DSA-5755-1
glance	source	(unstable)	2:28.0.1-3+deb12u1			1074761
nova	source	jessie	(unfixed)	end-of-life
nova	source	stretch	(unfixed)	end-of-life
nova	source	buster	(unfixed)	end-of-life
nova	source	bullseye	2:22.4.0-1~deb11u5		DLA-3873-1
nova	source	bookworm	2:26.2.2-1~deb12u3		DSA-5756-1
nova	source	(unstable)	2:29.0.2-4			1074762

Notes

https://www.openwall.com/lists/oss-security/2024/07/02/2
https://bugs.launchpad.net/nova/+bug/2059809
When fixing CVE-2024-33498 make sure to make the fix for src:nova complete to
not introduce CVE-2024-40767.