Red Hat Security Advisory

RHSA-2014:1787

openstack-cinder security and bug fix update

Released 2014-11-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-cinder-2014.1.3-1.el6ost, openstack-cinder-doc-2014.1.3-1.el6ost, python-cinder-2014.1.3-1.el6ost

Fixes 3 records

TI-2014-02962 CVE-2014-3641 · GHSA-qhch-g8qr-p497

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows…

LOW 23

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 h…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01875 Published 2014-10-08 Partial fix · 2014.1.3 CWE-200

TI-2014-06020 CVE-2014-7231 · GHSA-v933-vx5p-j7w2

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova…

LOW 12

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local use…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00532 Published 2014-10-08 Partial fix · 0.2.0 CWE-200

TI-2014-06019 CVE-2014-7230 · GHSA-58w7-wcrr-7289

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove…

LOW 12

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00488 Published 2014-10-08 Partial fix CWE-200