Ubuntu
nova package

Unauthorized volume access through deleted volume attachments (CVE-2023-2088)

Bug #2021980 reported by Corey Bryant
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Cloud Archive
Fix Released
High
Unassigned
Antelope
Fix Released
High
Unassigned
Bobcat
Fix Released
High
Unassigned
Ussuri
Won't Fix
Undecided
Unassigned
Victoria
Won't Fix
Undecided
Unassigned
Wallaby
Won't Fix
Undecided
Unassigned
Xena
Won't Fix
Undecided
Unassigned
Yoga
Fix Released
High
Unassigned
Zed
Fix Released
High
Unassigned
cinder (Ubuntu)
Fix Released
High
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
High
Unassigned
Kinetic
Won't Fix
High
Unassigned
Lunar
Fix Released
High
Unassigned
Mantic
Fix Released
High
Unassigned
ironic (Ubuntu)
Fix Released
High
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
High
Unassigned
Kinetic
Won't Fix
High
Unassigned
Lunar
Fix Released
High
Unassigned
Mantic
Fix Released
High
Unassigned
nova (Ubuntu)
Fix Released
High
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
High
Unassigned
Kinetic
Won't Fix
High
Unassigned
Lunar
Fix Released
High
Unassigned
Mantic
Fix Released
High
Unassigned
python-glance-store (Ubuntu)
Fix Released
High
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
High
Unassigned
Kinetic
Won't Fix
High
Unassigned
Lunar
Fix Released
High
Unassigned
Mantic
Fix Released
High
Unassigned
python-os-brick (Ubuntu)
Fix Released
High
Unassigned
Bionic
Won't Fix
Undecided
Unassigned
Focal
Won't Fix
Undecided
Unassigned
Jammy
Fix Released
High
Unassigned
Kinetic
Won't Fix
High
Unassigned
Lunar
Fix Released
High
Unassigned
Mantic
Fix Released
High
Unassigned

Bug Description

OpenStack security advisory: https://security.openstack.org/ossa/OSSA-2023-003.html

Note: This is the second attempt at patching this CVE. The first time with the embargo patches resulted in an ironic regression. There have also been additional changes since the embargo patches. We also want to coordinate documentation better this time as service tokens are now required.

See original description
Corey Bryant (corey.bryant)
Changed in nova (Ubuntu Jammy):
status: New → Triaged
importance: Undecided → High
Changed in nova (Ubuntu Kinetic):
status: New → Triaged
importance: Undecided → High
Changed in nova (Ubuntu Lunar):
status: New → Triaged
importance: Undecided → High
Changed in nova (Ubuntu Mantic):
status: New → Triaged
importance: Undecided → High
Changed in cinder (Ubuntu Jammy):
importance: Undecided → High
status: New → Triaged
Changed in cinder (Ubuntu Kinetic):
importance: Undecided → High
status: New → Triaged
Changed in cinder (Ubuntu Lunar):
importance: Undecided → High
status: New → Triaged
Changed in cinder (Ubuntu Mantic):
importance: Undecided → High
status: New → Triaged
no longer affects: cloud-archive/ussuri
Corey Bryant (corey.bryant)
Changed in ironic (Ubuntu Jammy):
importance: Undecided → High
status: New → Triaged
Changed in ironic (Ubuntu Kinetic):
importance: Undecided → High
status: New → Triaged
Changed in ironic (Ubuntu Lunar):
importance: Undecided → High
status: New → Triaged
Changed in ironic (Ubuntu Mantic):
importance: Undecided → High
status: New → Triaged
Changed in python-glance-store (Ubuntu Jammy):
importance: Undecided → High
status: New → Triaged
Changed in python-glance-store (Ubuntu Kinetic):
importance: Undecided → High
status: New → Triaged
Changed in python-glance-store (Ubuntu Lunar):
importance: Undecided → High
status: New → Triaged
Changed in python-glance-store (Ubuntu Mantic):
importance: Undecided → High
status: New → Triaged
Changed in python-os-brick (Ubuntu Mantic):
importance: Undecided → High
status: New → Triaged
Changed in python-os-brick (Ubuntu Lunar):
importance: Undecided → High
status: New → Triaged
Changed in python-os-brick (Ubuntu Kinetic):
importance: Undecided → High
status: New → Triaged
Changed in python-os-brick (Ubuntu Jammy):
importance: Undecided → High
status: New → Triaged
no longer affects: cloud-archive/victoria
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cinder - 2:22.0.0-0ubuntu4

---------------
cinder (2:22.0.0-0ubuntu4) mantic; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088-1.patch: Reject unsafe delete
      attachment calls.
    - debian/patches/CVE-2023-2088-2.patch: Doc: Improve service token.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Fri, 26 May 2023 16:16:03 -0400

Changed in cinder (Ubuntu Mantic):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ironic - 1:21.4.0-0ubuntu2

---------------
ironic (1:21.4.0-0ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Fix Cinder Integration
      fallout from CVE-2023-2088
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 14:42:54 -0400

Changed in ironic (Ubuntu Mantic):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package nova - 3:27.0.0-0ubuntu4

---------------
nova (3:27.0.0-0ubuntu4) mantic; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088-1.patch: Use force=True for os-brick
      disconnect during delete.
    - debian/patches/CVE-2023-2088-2.patch: Enable use of service user
      token with admin context.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 12:11:02 -0400

Changed in nova (Ubuntu Mantic):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-glance-store - 4.3.0-0ubuntu4

---------------
python-glance-store (4.3.0-0ubuntu4) mantic; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Add force to os-brick
      disconnect.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 14:53:17 -0400

Changed in python-glance-store (Ubuntu Mantic):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-os-brick - 6.2.0-0ubuntu5

---------------
python-os-brick (6.2.0-0ubuntu5) mantic; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Support force disconnect for
      fibre channel.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 15:05:40 -0400

Changed in python-os-brick (Ubuntu Mantic):
status: Triaged → Fix Released
Corey Bryant (corey.bryant)
Changed in cloud-archive:
status: Triaged → Fix Committed
Revision history for this message
Corey Bryant (corey.bryant) wrote :

This bug was fixed in the package cinder - 2:22.0.0-0ubuntu4~cloud0
---------------

 cinder (2:22.0.0-0ubuntu4~cloud0) jammy-bobcat; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 cinder (2:22.0.0-0ubuntu4) mantic; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
     - debian/patches/CVE-2023-2088-1.patch: Reject unsafe delete
       attachment calls.
     - debian/patches/CVE-2023-2088-2.patch: Doc: Improve service token.
     - CVE-2023-2088

Changed in cloud-archive:
status: Fix Committed → Fix Released
Corey Bryant (corey.bryant)
Changed in cinder (Ubuntu Bionic):
status: New → Won't Fix
Changed in cinder (Ubuntu Focal):
status: New → Won't Fix
Changed in ironic (Ubuntu Bionic):
status: New → Won't Fix
Changed in ironic (Ubuntu Focal):
status: New → Won't Fix
Changed in nova (Ubuntu Bionic):
status: New → Won't Fix
Changed in nova (Ubuntu Focal):
status: New → Won't Fix
Changed in python-glance-store (Ubuntu Bionic):
status: New → Won't Fix
Changed in python-glance-store (Ubuntu Focal):
status: New → Won't Fix
Changed in python-os-brick (Ubuntu Bionic):
status: New → Won't Fix
Changed in python-os-brick (Ubuntu Focal):
status: New → Won't Fix
Revision history for this message
Corey Bryant (corey.bryant) wrote :

Please see documentation for this issue at: https://discourse.ubuntu.com/t/cve-2023-2088-for-charmed-openstack/37051

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cinder - 2:20.2.0-0ubuntu1.1

---------------
cinder (2:20.2.0-0ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
      attachment calls.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 16:26:58 -0400

Changed in cinder (Ubuntu Jammy):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cinder - 2:22.0.0-0ubuntu1.3

---------------
cinder (2:22.0.0-0ubuntu1.3) lunar-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
      attachment calls.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 12:03:07 -0400

Changed in cinder (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package nova - 3:25.1.1-0ubuntu1.1

---------------
nova (3:25.1.1-0ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088-1.patch: Use force=True for os-brick
      disconnect during delete.
    - debian/patches/CVE-2023-2088-2.patch: Enable use of service user
      token with admin context.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 16:43:41 -0400

Changed in nova (Ubuntu Jammy):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ironic - 1:21.4.0-0ubuntu1.1

---------------
ironic (1:21.4.0-0ubuntu1.1) lunar-security; urgency=medium

  * d/gbp.conf: Create stable/2023.1 branch.
  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Fix Cinder Integration
      fallout from CVE-2023-2088
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 16:10:46 -0400

Changed in ironic (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-glance-store - 3.0.0-0ubuntu1.3

---------------
python-glance-store (3.0.0-0ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Add force to os-brick
      disconnect.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 15:48:16 -0400

Changed in python-glance-store (Ubuntu Jammy):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-os-brick - 6.2.0-0ubuntu2.3

---------------
python-os-brick (6.2.0-0ubuntu2.3) lunar-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Support force disconnect for
      fibre channel.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 15:19:28 -0400

Changed in python-os-brick (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-glance-store - 4.3.0-0ubuntu1.3

---------------
python-glance-store (4.3.0-0ubuntu1.3) lunar-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Add force to os-brick
      disconnect.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 15:42:32 -0400

Changed in python-glance-store (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package nova - 3:27.0.0-0ubuntu1.3

---------------
nova (3:27.0.0-0ubuntu1.3) lunar-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088-1.patch: Use force=True for os-brick
      disconnect during delete.
    - debian/patches/CVE-2023-2088-2.patch: Enable use of service user
      token with admin context.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 16:32:03 -0400

Changed in nova (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package python-os-brick - 5.2.2-0ubuntu1.2

---------------
python-os-brick (5.2.2-0ubuntu1.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Support force disconnect for
      fibre channel.
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 15:37:17 -0400

Changed in python-os-brick (Ubuntu Jammy):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ironic - 1:20.1.0-0ubuntu1.1

---------------
ironic (1:20.1.0-0ubuntu1.1) jammy-security; urgency=medium

  * d/gbp.conf: Create stable/yoga branch.
  * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
    - debian/patches/CVE-2023-2088.patch: Fix Cinder Integration
      fallout from CVE-2023-2088
    - CVE-2023-2088

 -- Corey Bryant <email address hidden> Wed, 31 May 2023 16:16:26 -0400

Changed in ironic (Ubuntu Jammy):
status: Triaged → Fix Released
Revision history for this message
Utkarsh Gupta (utkarsh) wrote :

Ubuntu 22.10 (Kinetic Kudu) has reached end of life, so this bug will not be fixed for that specific release.

Changed in nova (Ubuntu Kinetic):
status: Triaged → Won't Fix
Changed in cinder (Ubuntu Kinetic):
status: Triaged → Won't Fix
Changed in python-os-brick (Ubuntu Kinetic):
status: Triaged → Won't Fix
Changed in python-glance-store (Ubuntu Kinetic):
status: Triaged → Won't Fix
Changed in ironic (Ubuntu Kinetic):
status: Triaged → Won't Fix
Revision history for this message
James Page (james-page) wrote : Update Released

The verification of the Stable Release Update for cinder has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
James Page (james-page) wrote :
Download full text (4.2 KiB)

This bug was fixed in the package cinder - 2:23.0.0-0ubuntu1.4~cloud0
---------------

 cinder (2:23.0.0-0ubuntu1.4~cloud0) jammy; urgency=medium
 .
   * SECURITY UPDATE for Ubuntu Cloud Archive. backport to jammy.
 .
 cinder (2:23.0.0-0ubuntu1.4) mantic-security; urgency=medium
 .
   * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
     (LP: #2059809)
     - debian/patches/CVE-2024-32498.patch: check for external qcow2 data
       file.
     - debian/control: added qemu-utils to Build-Depends so qemu-img is
       available for new tests.
     - CVE-2024-32498
 .
 cinder (2:23.0.0-0ubuntu1.2) mantic; urgency=medium
 .
   [ Jorge Merlino ]
   * Increase size of volume image metadata values to 65535 bytes
     (LP: #1988942)
 .
   [ Heather Lemon ]
   * Start cinder-volume.service after tgt.service started (LP: #1987663)
     - d/cinder-volume.service.conf: drop-in with 'After=' and 'Wants='
       ('Wants=' is not generated by pkgos-gen-systemd-unit currently).
     - d/cinder-volume.install: ship the systemd service drop-in file.
 .
 cinder (2:23.0.0-0ubuntu1.1) mantic; urgency=medium
 .
   [ Corey Bryant ]
   * d/gbp.conf: Create stable/2023.2 branch.
   * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
     bobcat.
 .
   [ Edward Hope-Morley ]
   * revert driver assister volume retype (LP: #2019190)
     - d/p/0001-Revert-Driver-assisted-migration-on-retype-when-it-s.patch
 .
 cinder (2:23.0.0-0ubuntu1) mantic; urgency=medium
 .
   * New upstream release for OpenStack Bobcat.
 .
 cinder (2:23.0.0~rc1-0ubuntu1) mantic; urgency=medium
 .
   * New upstream release candidate for OpenStack Bobcat.
 .
 cinder (2:22.1.0+git2023090509.f79048d2-0ubuntu1) mantic; urgency=medium
 .
   * New upstream snapshot for OpenStack Bobcat.
   * d/p/install-missing-db-files.patch: Install missing db files, including
     cinder/db/alembic.ini.
 .
 cinder (2:22.1.0+git2023071214.c1a18fcd-0ubuntu1) mantic; urgency=medium
 .
   * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
     bobcat.
   * New upstream snapshot for OpenStack Bobcat.
   * d/control: Align (Build-)Depends with upstream.
   * d/p/skip-mock-spec-failures.patch: Dropped. No longer needed.
   * d/p/CVE-2023-2088-*.patch: Dropped. Fixed in snapshot.
 .
 cinder (2:22.0.0-0ubuntu4) mantic; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
     - debian/patches/CVE-2023-2088-1.patch: Reject unsafe delete
       attachment calls.
     - debian/patches/CVE-2023-2088-2.patch: Doc: Improve service token.
     - CVE-2023-2088
 .
 cinder (2:22.0.0-0ubuntu3) mantic; urgency=medium
 .
   * SECURITY REGRESSION: Regressions in other projects (LP: #2020111)
     - debian/patches/series: Do not apply CVE-2023-2088.patch until
       patches are ready for all upstream OpenStack projects.
     - CVE-2023-2088
 .
 cinder (2:22.0.0-0ubuntu2) mantic; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access
     - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
       attachment calls.
     - CVE-2023-2088
 .
 cinder (2:22.0.0-0ubuntu1) lunar; urgency=medium
 .
   * New upstream release for OpenStack Antelope.
   * d/p/s...

Read more...

Revision history for this message
James Page (james-page) wrote :

The verification of the Stable Release Update for nova has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
James Page (james-page) wrote :
Download full text (3.6 KiB)

This bug was fixed in the package nova - 3:28.0.1-0ubuntu1.3~cloud0
---------------

 nova (3:28.0.1-0ubuntu1.3~cloud0) jammy; urgency=medium
 .
   * SECURITY UPDATE for Ubuntu Cloud Archive. backport to jammy.
 .
 nova (3:28.0.1-0ubuntu1.3) mantic-security; urgency=medium
 .
   * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
     (LP: #2059809)
     - debian/patches/CVE-2024-32498-1.patch: reject qcow files with
       data-file attributes.
     - debian/patches/CVE-2024-32498-2.patch: check images with
       format_inspector for safety.
     - debian/patches/CVE-2024-32498-3.patch: additional qemu safety
       checking on base images.
     - debian/patches/CVE-2024-32498-4.patch: fix vmdk_allowed_types
       checking.
     - CVE-2024-32498
 .
 nova (3:28.0.1-0ubuntu1) mantic; urgency=medium
 .
   * d/gbp.conf: Create stable/2023.2 branch.
   * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
     bobcat.
   * New stable point release for OpenStack Bobcat (LP: #2046359).
 .
 nova (3:28.0.0-0ubuntu1) mantic; urgency=medium
 .
   * New upstream release for OpenStack Bobcat.
 .
 nova (3:27.1.0+git2023090509.82a17a37-0ubuntu1) mantic; urgency=medium
 .
   * New upstream snapshot for OpenStack Bobcat.
   * d/control: Align (Build-)Depends with upstream.
   * d/p/drop-actdiag.patch: Temporarily drop actdiag until bug fixed upstream.
   * d/p/install-missing-db-files.patch: Install missing db files, including
     nova/db/api/alembic.ini and nova/db/main/alembic.ini.
 .
 nova (3:27.1.0+git2023071215.f7ce4df5-0ubuntu1) mantic; urgency=medium
 .
   * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
     bobcat.
   * d/p/skip-if-https-proxy.patch: Test skipped if https-proxy is set
     as lpci builds in .launchpad.yaml do.
   * New upstream snapshot for OpenStack Bobcat.
   * d/p/CVE-2023-2088-*.patch: Dropped. Fixed in snapshot.
 .
 nova (3:27.0.0-0ubuntu4) mantic; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
     - debian/patches/CVE-2023-2088-1.patch: Use force=True for os-brick
       disconnect during delete.
     - debian/patches/CVE-2023-2088-2.patch: Enable use of service user
       token with admin context.
     - CVE-2023-2088
 .
 nova (3:27.0.0-0ubuntu3) mantic; urgency=medium
 .
   * SECURITY REGRESSION: Regressions in other projects (LP: #2020111)
     - debian/patches/series: Do not apply CVE-2023-2088.patch until
       patches are ready for all upstream OpenStack projects.
     - CVE-2023-2088
 .
 nova (3:27.0.0-0ubuntu2) mantic; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access
     - debian/patches/CVE-2023-2088.patch: Use force=True for os-brick
       disconnect during delete.
     - CVE-2023-2088
 .
 nova (3:27.0.0-0ubuntu1) lunar; urgency=medium
 .
   * New upstream release for OpenStack Antelope.
 .
 nova (3:26.1.0+git2023030309.59f7a524-0ubuntu2) lunar; urgency=medium
 .
   * d/nova-compute-qemu.postinst: Add nova user to kvm group (LP: #2011535).
 .
 nova (3:26.1.0+git2023030309.59f7a524-0ubuntu1) lunar; urgency=medium
 .
   * d/watch: Drop major version.
   * New upstream snapshot for OpenStack Antelope.
 .
 nova (3:26....

Read more...

Revision history for this message
James Page (james-page) wrote :

The verification of the Stable Release Update for cinder has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
James Page (james-page) wrote :
Download full text (8.8 KiB)

This bug was fixed in the package cinder - 2:20.3.1-0ubuntu1.4~cloud0
---------------

 cinder (2:20.3.1-0ubuntu1.4~cloud0) focal; urgency=medium
 .
   * SECURITY UPDATE for Ubuntu Cloud Archive. backport to focal.
 .
 cinder (2:20.3.1-0ubuntu1.4) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
     (LP: #2059809)
     - debian/patches/CVE-2024-32498.patch: check for external qcow2 data
       file.
     - debian/control: added qemu-utils to Build-Depends so qemu-img is
       available for new tests.
     - CVE-2024-32498
 .
 cinder (2:20.3.1-0ubuntu1.2) jammy; urgency=medium
 .
   [ Jorge Merlino ]
   * Increase size of volume image metadata values to 65535 bytes
     (LP: #1988942)
 .
   [ Heather Lemon ]
   * Start cinder-volume.service after tgt.service started (LP: #1987663)
     - d/cinder-volume.service.conf: drop-in with 'After=' and 'Wants='
       ('Wants=' is not generated by pkgos-gen-systemd-unit currently).
     - d/cinder-volume.install: ship the systemd service drop-in file.
 .
   [ Seyeong Kim ]
   * HPE3PAR: Failing to clone a volume having children (LP: #1994521):
     - d/p/0001-HPE-3PAR-Fix-umanaged-volumes-snapshots-missing.patch
     - d/p/0002-3PAR-Error-out-if-vol-cannot-be-converted-to-base.patch
     - api 4.0.17 is added as it is in the middle of the main patch
       (4.0.18)
 .
 cinder (2:20.3.1-0ubuntu1.1) jammy; urgency=medium
 .
   * Revert driver assisted volume retype (LP: #2019190):
     - d/p/0001-Revert-Driver-assisted-migration-on-retype-when-it-s.patch
 .
 cinder (2:20.3.1-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2037332).
 .
 cinder (2:20.3.0-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2025503).
   * d/p/CVE-2023-2088.patch: Dropped. Fixed in point release.
 .
 cinder (2:20.2.0-0ubuntu1.1) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
     - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
       attachment calls.
     - CVE-2023-2088
 .
 cinder (2:20.2.0-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2019759).
   * d/p/lp1945500.patch: Dropped. Fixed in stable point release.
 .
 cinder (2:20.1.0-0ubuntu2.2) jammy-security; urgency=medium
 .
   * SECURITY REGRESSION: Regressions in other projects (LP: #2020111)
     - debian/patches/series: Do not apply CVE-2023-2088.patch until
       patches are ready for all upstream OpenStack projects.
     - CVE-2023-2088
 .
 cinder (2:20.1.0-0ubuntu2.1) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access
     - debian/patches/CVE-2023-2088.patch: Reject unsafe delete
       attachment calls.
     - CVE-2023-2088
 .
 cinder (2:20.1.0-0ubuntu2) jammy; urgency=medium
 .
   * d/p/lp1945500.patch: Filter reserved image properties (LP: #1945500).
 .
 cinder (2:20.1.0-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2004030).
 .
 cinder (2:20.0.1-0ubuntu1) jammy; urgency=medium
 .
   * d/gbp.conf: Create stable/yoga branch.
   * New stable point r...

Read more...

Revision history for this message
James Page (james-page) wrote :

The verification of the Stable Release Update for nova has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
James Page (james-page) wrote :
Download full text (8.2 KiB)

This bug was fixed in the package nova - 3:25.2.1-0ubuntu2.3~cloud0
---------------

 nova (3:25.2.1-0ubuntu2.3~cloud0) focal; urgency=medium
 .
   * SECURITY UPDATE for Ubuntu Cloud Archive. backport to focal.
 .
 nova (3:25.2.1-0ubuntu2.3) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
     (LP: #2059809)
     - debian/patches/CVE-2024-32498-pre1.patch: consolidate
       create_cow_image and create_image.
     - debian/patches/CVE-2024-32498-1.patch: reject qcow files with
       data-file attributes.
     - debian/patches/CVE-2024-32498-2.patch: check images with
       format_inspector for safety.
     - debian/patches/CVE-2024-32498-3.patch: additional qemu safety
       checking on base images.
     - debian/patches/CVE-2024-32498-4.patch: fix vmdk_allowed_types
       checking.
     - CVE-2024-32498
 .
 nova (3:25.2.1-0ubuntu2) jammy; urgency=medium
 .
   * d/p/libvirt-remove-default-cputune-shares-value.patch:
     Enable launch of instances with more than 9 CPUs on Jammy
     (LP: #1978489).
 .
 nova (3:25.2.1-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2037332).
 .
 nova (3:25.2.0-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2025503).
   * d/p/CVE-2023-2088-*.patch: Dropped. Fixed in point release.
 .
 nova (3:25.1.1-0ubuntu1.1) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access (LP: #2021980)
     - debian/patches/CVE-2023-2088-1.patch: Use force=True for os-brick
       disconnect during delete.
     - debian/patches/CVE-2023-2088-2.patch: Enable use of service user
       token with admin context.
     - CVE-2023-2088
 .
 nova (3:25.1.1-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2019759).
   * d/p/ignore-deleted-server-groups-in-validation.patch: Dropped. Fixed
     in stable point release.
 .
 nova (3:25.1.0-0ubuntu2.2) jammy-security; urgency=medium
 .
   * SECURITY REGRESSION: Regressions in other projects (LP: #2020111)
     - debian/patches/series: Do not apply CVE-2023-2088.patch until
       patches are ready for all upstream OpenStack projects.
     - CVE-2023-2088
 .
 nova (3:25.1.0-0ubuntu2.1) jammy-security; urgency=medium
 .
   * SECURITY UPDATE: Unauthorized File Access
     - debian/patches/CVE-2023-2088.patch: Use force=True for os-brick
       disconnect during delete.
     - CVE-2023-2088
 .
 nova (3:25.1.0-0ubuntu2) jammy; urgency=medium
 .
   * Backport fix to ignore deleted server groups (LP: #1890244)
     d/p/ignore-deleted-server-groups-in-validation.patch
 .
 nova (3:25.1.0-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #2004030).
 .
 nova (3:25.0.1-0ubuntu1) jammy; urgency=medium
 .
   * New stable point release for OpenStack Yoga (LP: #1980369).
 .
 nova (3:25.0.0-0ubuntu1.1) jammy; urgency=medium
 .
   [ Corey Bryant ]
   * d/gbp.conf: Create stable/yoga branch.
 .
   [ Felipe Reyes ]
   * d/nova-common.postinst: Don't change file permissions under
     /var/lib/nova/.ssh (LP: #1904580).
 .
 nova (3:25.0.0-0ubuntu1) jammy; urgency=med...

Read more...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.