USN-7095-1: Linux kernel vulnerabilities

USN-6882-2: Cinder regression
7 November 2024

USN-6882-1 introduced a regression in Cinder.

Releases
Ubuntu 24.04 LTS Ubuntu 22.04 LTS Ubuntu 20.04 LTS

Packages
cinder - OpenStack storage service

Details
USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression
in certain environments due to incorrect privilege handling. This update
fixes the problem.

We apologize for the inconvenience.

Original advisory details:
Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image
processing. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• python3-cinder - 2:24.0.0-0ubuntu1.3

In general, a standard system update will make all the necessary changes.