Openstack Security Advisory: OSSA-2023-003: Unauthorized volume access through deleted volume attachments

[Thales Elero Cervi]

Brief Description
-----------------
There is a new Openstack Security Advisory: https://security.openstack.org/ossa/OSSA-2023-003.html

It needs to be evaluated after the OpenStack services upversion to Antelope: https://storyboard.openstack.org/#!/story/2010715

In case this is still a security issue, we should port the solution.

Severity
--------
Medium: Security Issue

Steps to Reproduce
------------------
N/A

Expected Behavior
------------------
N/A

Actual Behavior
----------------
N/A

Reproducibility
---------------
Reproducible

System Configuration
--------------------
N/A

Branch/Pull Time/Commit
-----------------------
stx main branch

Last Pass
---------
N/A

Timestamp/Logs
--------------
N/A

Test Activity
-------------
Security vulnerabilities review

Workaround
----------
None

[Thales Elero Cervi (tcervi)]

Next StarlingX relese (stx.9.0) will deliver an stx-openstack application with OpenStack Antelope based images generated on top of the `stable/2023.1` branch and all affected services have a fix for this on this branch (note that we don't build glance_store or os-brick images):

    Cinder: https://review.opendev.org/c/openstack/cinder/+/882836
    Nova: https://review.opendev.org/c/openstack/cinder/+/882836
    Glance store: https://review.opendev.org/c/openstack/glance_store/+/882851
    OS Brick: https://review.opendev.org/c/openstack/os-brick/+/882843

[Thales Elero Cervi (tcervi)]

Cinder uprev: https://opendev.org/starlingx/openstack-armada-app/commit/c5b060f24bc2261937ba627801ece55d1040f614
Nova uprev: https://opendev.org/starlingx/openstack-armada-app/commit/d4c18262d47c8b84c6268de277d86b7b807a4450