PT-2016-5023 · Openstack+1 · Openstack Compute+1

Matthew Booth · Published 2016-04-12 · Updated 2023-02-13 · CVE-2016-2140

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to 2015.1.4 (kilo) OpenStack Compute (Nova) versions 12.0.x prior to 12.0.3 (liberty)

Description The issue allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk when using raw storage and the use cow images option is set to false.

Recommendations For OpenStack Compute (Nova) versions prior to 2015.1.4 (kilo), update to version 2015.1.4 or later. For OpenStack Compute (Nova) versions 12.0.x prior to 12.0.3 (liberty), update to version 12.0.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-2140

GHSA-49JV-37HM-6GFP

RHSA-2016:0363

RHSA-2016:0364

RHSA-2016:0365

RHSA-2016:0366

SUSE-SU-2016:2143-1

USN-3449-1

Affected Products

Openstack Compute

Ubuntu

References · 44

• https://osv.dev/vulnerability/GHSA-49jv-37hm-6gfp · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7713 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2140 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2143-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8749 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2140 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3449-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2140 · Security Note
• https://ubuntu.com/security/CVE-2015-5162 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-007.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3449-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3241 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2140 · Vendor Advisory