What’s Vulnerable › Vulnerabilities

CVE-2024-32498

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-05 · updated 2026-06-17
• Weakness: CWE-552

Description

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Affected products

• OpenStack Cinder: before 22.1.3; from 23.0.0 before 23.1.1; 24.0.0 — fixed in 22.1.3, 23.1.1
• OpenStack Glance: before 26.0.1; from 28.0.0 before 28.0.2; 27.0.0 — fixed in 26.0.1, 28.0.2
• OpenStack Nova: before 27.3.1; from 28.0.0 before 28.1.1; from 29.0.0 before 29.0.3 — fixed in 27.3.1, 28.1.1, 29.0.3

How to fix

Upgrade to a fixed version: OpenStack Cinder 22.1.3, 23.1.1; OpenStack Glance 26.0.1, 28.0.2; OpenStack Nova 27.3.1, 28.1.1, 29.0.3. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/07/02/2
• https://launchpad.net/bugs/2059809
• https://security.openstack.org/ossa/OSSA-2024-001.html
• https://www.openwall.com/lists/oss-security/2024/07/02/2
• http://www.openwall.com/lists/oss-security/2024/07/02/2
• https://launchpad.net/bugs/2059809
• https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html
• https://www.openwall.com/lists/oss-security/2024/07/02/2

Get alerted when CVE-2024-32498 or the next vulnerability affects your stack