Security update for openstack-cinder, openstack-glance, openstack-neutron-gbp, openstack-nova, python-oslo.utils SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0844-1 Final 1 1 2023-03-21T12:25:22Z current 2023-03-21T12:25:22Z 2023-03-21T12:25:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openstack-cinder, openstack-glance, openstack-neutron-gbp, openstack-nova, python-oslo.utils This update for openstack-cinder, openstack-glance, openstack-neutron-gbp, openstack-nova, python-oslo.utils contains the following fixes: Security fixes included on this update: openstack-cinder, openstack-glance, openstack-nova: - CVE-2022-47951: Fixed file access control through custom VMDK flat descriptor. (bsc#1207321) Non-security changes included on this update: Changes in openstack-cinder: - Fixed file access control through custom VMDK flat descriptor. (bsc#1207321, CVE-2022-47951) Changes in openstack-glance: - Enforce image safety during image_conversion. (bsc#1207321, CVE-2022-47951) Changes in openstack-neutron-gbp: - Update to version group-based-policy-14.0.1.dev58: * Add no nat cidrs network extension - Update to version group-based-policy-14.0.1.dev57: * Cleanup stable branches - Update to version group-based-policy-14.0.1.dev56: * Revert 'Add no nat cidrs network extension' 2014.2.0rc1 - Update to version group-based-policy-14.0.1.dev55: * Add no nat cidrs network extension 2014.2rc1 - Update to version group-based-policy-14.0.1.dev54: * Add python39 gate support * Fixes for tox4 Changes in openstack-nova: - Fixed file access control through custom VMDK flat descriptor. (bsc#1207321, CVE-2022-47951) Changes in python-oslo.utils: - Report format specific details when using JSON output format. (bsc#1207321) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-844,SUSE-OpenStack-Cloud-9-2023-844,SUSE-OpenStack-Cloud-Crowbar-9-2023-844 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230844-1/ Link for SUSE-SU-2023:0844-1 https://lists.suse.com/pipermail/sle-security-updates/2023-March/014127.html E-Mail link for SUSE-SU-2023:0844-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207321 SUSE Bug 1207321 https://www.suse.com/security/cve/CVE-2022-47951/ SUSE CVE CVE-2022-47951 page SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 openstack-cinder-13.0.10~dev24-3.37.2 openstack-cinder-api-13.0.10~dev24-3.37.2 openstack-cinder-backup-13.0.10~dev24-3.37.2 openstack-cinder-scheduler-13.0.10~dev24-3.37.2 openstack-cinder-test-13.0.10~dev24-3.37.2 openstack-cinder-volume-13.0.10~dev24-3.37.2 openstack-glance-17.0.1~dev30-3.6.2 openstack-glance-api-17.0.1~dev30-3.6.2 openstack-glance-registry-17.0.1~dev30-3.6.2 openstack-glance-test-17.0.1~dev30-3.6.2 openstack-neutron-gbp-14.0.1~dev58-3.40.1 openstack-neutron-gbp-test-14.0.1~dev58-3.40.1 openstack-nova-18.3.1~dev92-3.46.1 openstack-nova-api-18.3.1~dev92-3.46.1 openstack-nova-cells-18.3.1~dev92-3.46.1 openstack-nova-compute-18.3.1~dev92-3.46.1 openstack-nova-conductor-18.3.1~dev92-3.46.1 openstack-nova-console-18.3.1~dev92-3.46.1 openstack-nova-consoleauth-18.3.1~dev92-3.46.1 openstack-nova-network-18.3.1~dev92-3.46.1 openstack-nova-novncproxy-18.3.1~dev92-3.46.1 openstack-nova-placement-api-18.3.1~dev92-3.46.1 openstack-nova-scheduler-18.3.1~dev92-3.46.1 openstack-nova-serialproxy-18.3.1~dev92-3.46.1 openstack-nova-test-18.3.1~dev92-3.46.1 openstack-nova-vncproxy-18.3.1~dev92-3.46.1 python-cinder-13.0.10~dev24-3.37.2 python-glance-17.0.1~dev30-3.6.2 python-neutron-gbp-14.0.1~dev58-3.40.1 python-nova-18.3.1~dev92-3.46.1 python-oslo.utils-3.36.5-3.6.1 python-oslo.utils-doc-3.36.5-3.6.1 python3-oslo.utils-3.36.5-3.6.1 venv-openstack-barbican-x86_64-7.0.1~dev24-3.39.1 venv-openstack-cinder-x86_64-13.0.10~dev24-3.40.1 venv-openstack-designate-x86_64-7.0.2~dev2-3.37.1 venv-openstack-glance-x86_64-17.0.1~dev30-3.35.1 venv-openstack-heat-x86_64-11.0.4~dev4-3.39.1 venv-openstack-horizon-x86_64-14.1.1~dev11-4.45.1 venv-openstack-ironic-x86_64-11.1.5~dev18-4.35.1 venv-openstack-keystone-x86_64-14.2.1~dev9-3.38.1 venv-openstack-magnum-x86_64-7.2.1~dev1-4.37.1 venv-openstack-manila-x86_64-7.4.2~dev60-3.43.1 venv-openstack-monasca-ceilometer-x86_64-1.8.2~dev3-3.37.1 venv-openstack-monasca-x86_64-2.7.1~dev10-3.39.1 venv-openstack-neutron-x86_64-13.0.8~dev209-6.45.1 venv-openstack-nova-x86_64-18.3.1~dev92-3.45.1 venv-openstack-octavia-x86_64-3.2.3~dev7-4.37.1 venv-openstack-sahara-x86_64-9.0.2~dev15-3.37.1 venv-openstack-swift-x86_64-2.19.2~dev48-2.32.1 openstack-cinder-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 openstack-cinder-api-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 openstack-cinder-backup-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 openstack-cinder-scheduler-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 openstack-cinder-volume-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 openstack-glance-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud 9 openstack-glance-api-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud 9 openstack-neutron-gbp-14.0.1~dev58-3.40.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-api-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-cells-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-compute-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-conductor-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-console-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-novncproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-placement-api-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-scheduler-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-serialproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 openstack-nova-vncproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 python-cinder-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud 9 python-glance-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud 9 python-neutron-gbp-14.0.1~dev58-3.40.1 as a component of SUSE OpenStack Cloud 9 python-nova-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud 9 python-oslo.utils-3.36.5-3.6.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-barbican-x86_64-7.0.1~dev24-3.39.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-cinder-x86_64-13.0.10~dev24-3.40.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-designate-x86_64-7.0.2~dev2-3.37.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-glance-x86_64-17.0.1~dev30-3.35.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-heat-x86_64-11.0.4~dev4-3.39.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-horizon-x86_64-14.1.1~dev11-4.45.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-ironic-x86_64-11.1.5~dev18-4.35.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-keystone-x86_64-14.2.1~dev9-3.38.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-magnum-x86_64-7.2.1~dev1-4.37.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-manila-x86_64-7.4.2~dev60-3.43.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-monasca-ceilometer-x86_64-1.8.2~dev3-3.37.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-monasca-x86_64-2.7.1~dev10-3.39.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-neutron-x86_64-13.0.8~dev209-6.45.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-nova-x86_64-18.3.1~dev92-3.45.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-octavia-x86_64-3.2.3~dev7-4.37.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-sahara-x86_64-9.0.2~dev15-3.37.1 as a component of SUSE OpenStack Cloud 9 venv-openstack-swift-x86_64-2.19.2~dev48-2.32.1 as a component of SUSE OpenStack Cloud 9 openstack-cinder-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-cinder-api-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-cinder-backup-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-cinder-scheduler-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-cinder-volume-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-glance-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-glance-api-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-neutron-gbp-14.0.1~dev58-3.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-api-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-cells-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-compute-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-conductor-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-console-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-novncproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-placement-api-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-scheduler-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-serialproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-nova-vncproxy-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 python-cinder-13.0.10~dev24-3.37.2 as a component of SUSE OpenStack Cloud Crowbar 9 python-glance-17.0.1~dev30-3.6.2 as a component of SUSE OpenStack Cloud Crowbar 9 python-neutron-gbp-14.0.1~dev58-3.40.1 as a component of SUSE OpenStack Cloud Crowbar 9 python-nova-18.3.1~dev92-3.46.1 as a component of SUSE OpenStack Cloud Crowbar 9 python-oslo.utils-3.36.5-3.6.1 as a component of SUSE OpenStack Cloud Crowbar 9 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. CVE-2022-47951 SUSE OpenStack Cloud 9:openstack-cinder-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:openstack-cinder-api-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:openstack-cinder-backup-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:openstack-cinder-scheduler-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:openstack-cinder-volume-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:openstack-glance-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud 9:openstack-glance-api-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud 9:openstack-neutron-gbp-14.0.1~dev58-3.40.1 SUSE OpenStack Cloud 9:openstack-nova-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-api-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-cells-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-compute-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-conductor-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-console-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-novncproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-placement-api-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-scheduler-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-serialproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:openstack-nova-vncproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:python-cinder-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud 9:python-glance-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud 9:python-neutron-gbp-14.0.1~dev58-3.40.1 SUSE OpenStack Cloud 9:python-nova-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud 9:python-oslo.utils-3.36.5-3.6.1 SUSE OpenStack Cloud 9:venv-openstack-barbican-x86_64-7.0.1~dev24-3.39.1 SUSE OpenStack Cloud 9:venv-openstack-cinder-x86_64-13.0.10~dev24-3.40.1 SUSE OpenStack Cloud 9:venv-openstack-designate-x86_64-7.0.2~dev2-3.37.1 SUSE OpenStack Cloud 9:venv-openstack-glance-x86_64-17.0.1~dev30-3.35.1 SUSE OpenStack Cloud 9:venv-openstack-heat-x86_64-11.0.4~dev4-3.39.1 SUSE OpenStack Cloud 9:venv-openstack-horizon-x86_64-14.1.1~dev11-4.45.1 SUSE OpenStack Cloud 9:venv-openstack-ironic-x86_64-11.1.5~dev18-4.35.1 SUSE OpenStack Cloud 9:venv-openstack-keystone-x86_64-14.2.1~dev9-3.38.1 SUSE OpenStack Cloud 9:venv-openstack-magnum-x86_64-7.2.1~dev1-4.37.1 SUSE OpenStack Cloud 9:venv-openstack-manila-x86_64-7.4.2~dev60-3.43.1 SUSE OpenStack Cloud 9:venv-openstack-monasca-ceilometer-x86_64-1.8.2~dev3-3.37.1 SUSE OpenStack Cloud 9:venv-openstack-monasca-x86_64-2.7.1~dev10-3.39.1 SUSE OpenStack Cloud 9:venv-openstack-neutron-x86_64-13.0.8~dev209-6.45.1 SUSE OpenStack Cloud 9:venv-openstack-nova-x86_64-18.3.1~dev92-3.45.1 SUSE OpenStack Cloud 9:venv-openstack-octavia-x86_64-3.2.3~dev7-4.37.1 SUSE OpenStack Cloud 9:venv-openstack-sahara-x86_64-9.0.2~dev15-3.37.1 SUSE OpenStack Cloud 9:venv-openstack-swift-x86_64-2.19.2~dev48-2.32.1 SUSE OpenStack Cloud Crowbar 9:openstack-cinder-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:openstack-cinder-api-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:openstack-cinder-backup-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:openstack-cinder-scheduler-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:openstack-cinder-volume-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:openstack-glance-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud Crowbar 9:openstack-glance-api-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud Crowbar 9:openstack-neutron-gbp-14.0.1~dev58-3.40.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-api-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-cells-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-compute-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-conductor-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-console-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-novncproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-placement-api-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-scheduler-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-serialproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:openstack-nova-vncproxy-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:python-cinder-13.0.10~dev24-3.37.2 SUSE OpenStack Cloud Crowbar 9:python-glance-17.0.1~dev30-3.6.2 SUSE OpenStack Cloud Crowbar 9:python-neutron-gbp-14.0.1~dev58-3.40.1 SUSE OpenStack Cloud Crowbar 9:python-nova-18.3.1~dev92-3.46.1 SUSE OpenStack Cloud Crowbar 9:python-oslo.utils-3.36.5-3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230844-1/ https://www.suse.com/security/cve/CVE-2022-47951.html CVE-2022-47951 https://bugzilla.suse.com/1207321 SUSE Bug 1207321