Read the docs
TI-2023-01963 Aliases CVE-2023-2088GHSA-fvf4-jv3j-73mq

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova.

Priority LOW 31CWE-440Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01198 68th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OpenStackunknown—No fix listedCNA
  • OpenStack Vendor— Affected unknown Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:openstack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2023:3161 Released 2023-05-17 · Red Hat rating Critical
    Red Hat OpenStack Platform 13.0 security update
    • Red Hat OpenStack Platform 13.0 - ELS openstack-nova-1:17.0.13-41.el7ost, openstack-nova-api-1:17.0.13-41.el7ost, openstack-nova-cells-1:17.0.13-41.el7ost +17
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-nova-1:17.0.13-41.el7ost, openstack-nova-api-1:17.0.13-41.el7ost, openstack-nova-cells-1:17.0.13-41.el7ost +17
  • RHSA-2023:3158 Released 2023-05-17 · Red Hat rating Critical
    Red Hat OpenStack Platform 16.2 security update
    • Red Hat OpenStack Platform 16.2 openstack-cinder-1:15.6.1-2.20230310075425.a19c1c9.el8ost, openstack-nova-1:20.6.2-2.20230308185149.el8ost, openstack-nova-api-1:20.6.2-2.20230308185149.el8ost +16
  • RHSA-2023:3157 Released 2023-05-17 · Red Hat rating Critical
    Red Hat OpenStack Platform 17.0 security update
    • Red Hat OpenStack Platform 17.0 openstack-cinder-1:18.2.1-0.20230509200451.1776695.el9ost, openstack-nova-1:23.2.2-0.20221209190754.7074ac0.el9ost, openstack-nova-api-1:23.2.2-0.20221209190754.7074ac0.el9ost +16
Show 1 more Red Hat advisories
  • RHSA-2023:3156 Released 2023-05-17 · Red Hat rating Critical
    Red Hat OpenStack Platform 16.1 security update
    • Red Hat OpenStack Platform 16.1 openstack-cinder-1:15.4.0-1.20230510003501.58f0e73.el8ost, openstack-nova-1:20.4.1-1.20221005193232.el8ost, openstack-nova-api-1:20.4.1-1.20221005193232.el8ost +15

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2023:3161
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2023:3161
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:3156
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:3158
Red Hat OpenStack Platform 17.0Fixed RHSA-2023:3157
Not affected: 1 product
  • Red Hat OpenStack Platform 16.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2088
  2. 2026-10-03 Alias added: GHSA-fvf4-jv3j-73mq

References

Other 2

  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2018-07980 Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis… CVSS 3.0CRITICAL 9.8
  • TI-2020-07599 Apache HTTP Server versions 2.4.20 to 2.4.43. CVSS 3.1HIGH 7.5
  • TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2018-15768 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume… CVSS 3.0HIGH 7.5
  • TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
See all 209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences