Every CVE Search/ Get API key

CVE-2024-32498

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

6.5 MediumFix available

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.83%Up 0.8 points since Jul 5, 2024
90%50%10%1%

What each source reports

NVD Score used 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
CVE-2024-32498
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-552
Updated
2026-11-02
CVE List 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
CVE-2024-32498
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-552
Updated
2026-11-02
EUVDEUVD-2024-2409 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
EUVD-2024-2409
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r4v4-w9pv-6fph 7.1

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
GHSA-r4v4-w9pv-6fph
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-552
Updated
2026-11-02
OSV 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
CVE-2024-32498
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-32498 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
DEBIAN-CVE-2024-32498
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-r4v4-w9pv-6fph 7.1

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
GHSA-r4v4-w9pv-6fph
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-552
Updated
2026-11-02
OSVPYSEC-2026-1708 7.1

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
PYSEC-2026-1708
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2026-2414 7.1

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
PYSEC-2026-2414
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2026-2493 7.1

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
PYSEC-2026-2493
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:4272 8.8

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.3 security update

Record
RHSA-2024:4272
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:4273 8.8

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.6 security update

Record
RHSA-2024:4273
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:4274 8.8

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.3 (openstack-nova) security update

Record
RHSA-2024:4274
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:4425 8.8

Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 security update

Record
RHSA-2024:4425
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-32498 6.5

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

Record
UBUNTU-CVE-2024-32498
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUSN-6882-1 No score

cinder vulnerability

Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Record
USN-6882-1
Updated
2026-11-02
OSVUSN-6882-2 No score

cinder regression

USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Martin Kaesberger discovered that Cinder incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Record
USN-6882-2
Updated
2026-11-02
OSVUSN-6883-1 No score

glance vulnerability

Martin Kaesberger discovered that Glance incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Record
USN-6883-1
Updated
2026-11-02
OSVUSN-6884-1 No score

nova vulnerability

Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image processing. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Record
USN-6884-1
Updated
2026-11-02
OSVUSN-8199-1 No score

glance vulnerabilities

Martin Kaesberger discovered that OpenStack Glance's image processing could return the contents of arbitrary files. An attacker could possibly use this issue to exfiltrate sensitive data. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-32498)

Hyeongeun Ji and Abhishek Kekane discovered several server-side request forgery vulnerabilities in OpenStack Glance's image import. An attacker could possibly use this issue to bypass URL validation checks and redirect to internal services. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-34881)

Record
USN-8199-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cinder
PyPI
 through 24.0.0 None known
glance
PyPI
 through 28.0.1 None known
nova
PyPI
 through 29.0.2 None known
cinder
Debian:12
 before 2:21.3.1-1~deb12u1, plus listed versions
2:21.1.0-3
2:21.3.1-1~deb12u1
cinder
Debian:13
 before 2:24.0.0-5
2:24.0.0-5
cinder
Debian:14
 before 2:24.0.0-5
2:24.0.0-5
glance
Debian:12
 before 2:25.1.0-2+deb12u1, plus listed versions
2:25.1.0-2
2:25.1.0-2+deb12u1
glance
Debian:13
 before 2:28.0.1-3+deb12u1
2:28.0.1-3+deb12u1
glance
Debian:14
 before 2:28.0.1-3+deb12u1
2:28.0.1-3+deb12u1
nova
Debian:12
 before 2:26.2.2-1~deb12u3, plus listed versions
2:26.1.0-4
2:26.2.2-1~deb12u3
Show 80 moreShow less
Affected packages
PackageAffectedFixed
nova
Debian:13
 before 2:29.0.2-4
2:29.0.2-4
nova
Debian:14
 before 2:29.0.2-4
2:29.0.2-4
cinder
Debian:11
From an advisory covering 2 CVEs
 before 2:17.4.0-1~deb11u2, plus listed versions
2:17.0.1-12:17.0.1-1+deb11u1
2:17.4.0-1~deb11u2
glance
Debian:11
 before 2:21.1.0-1+deb11u2, plus listed versions
2:21.0.0-22:21.0.0-2+deb11u1
2:21.1.0-1+deb11u2
nova
Debian:11
 before 2:22.4.0-1~deb11u5, plus listed versions
2:22.0.1-22:22.0.1-2+deb11u1
2:22.4.0-1~deb11u5
cinder
PyPI
 through 24.0.0, plus listed versions
10.0.811.2.011.2.111.2.212.0.10
Show 45 moreShow less
12.0.412.0.512.0.612.0.712.0.812.0.913.0.113.0.213.0.313.0.413.0.513.0.613.0.713.0.813.0.914.0.014.0.0.0rc114.0.0.0rc214.0.114.0.214.0.314.0.414.1.014.2.014.2.114.3.014.3.115.0.015.0.0.0rc115.0.0.0rc215.0.115.1.015.2.015.3.015.4.015.4.115.5.015.6.016.0.016.0.0.0b116.0.0.0rc116.0.0.0rc216.0.0.0rc316.1.016.2.0
 None known
glance
PyPI
 through 28.0.1, plus listed versions
15.0.217.0.118.0.018.0.0.0b118.0.0.0rc1
Show 45 moreShow less
18.0.119.0.019.0.0.0b119.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.0.420.0.020.0.0.0b120.0.0.0b220.0.0.0b320.0.0.0rc120.0.0.0rc220.0.120.1.020.2.021.0.021.0.0.0b121.0.0.0b221.0.0.0rc121.0.0.0rc221.1.022.0.022.0.0.0b222.0.0.0b322.0.0.0rc122.1.022.1.123.0.023.0.0.0b223.0.0.0b323.0.0.0rc123.0.0.0rc223.1.024.0.024.0.0.0rc124.1.024.2.024.2.125.0.025.0.0.0b225.0.0.0b325.0.0.0rc1
 None known
nova
PyPI
 through 29.0.2, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
 None known
openstack-cinder
Red Hat:openstack:17.1::el9
 before 1:18.2.2-17.1.20231011140829.el9ost
1:18.2.2-17.1.20231011140829.el9ost
openstack-glance
Red Hat:openstack:17.1::el9
 before 1:22.1.2-17.1.20230621071326.el9ost
1:22.1.2-17.1.20230621071326.el9ost
openstack-nova
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-api
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-common
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-compute
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-conductor
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-migration
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-novncproxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-scheduler
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-serialproxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
python3-cinder
Red Hat:openstack:17.1::el9
 before 1:18.2.2-17.1.20231011140829.el9ost
1:18.2.2-17.1.20231011140829.el9ost
python3-cinder-common
Red Hat:openstack:17.1::el9
 before 1:18.2.2-17.1.20231011140829.el9ost
1:18.2.2-17.1.20231011140829.el9ost
python3-glance
Red Hat:openstack:17.1::el9
 before 1:22.1.2-17.1.20230621071326.el9ost
1:22.1.2-17.1.20230621071326.el9ost
python3-nova
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130828.el9ost
1:23.2.3-17.1.20231018130828.el9ost
openstack-cinder
Red Hat:openstack:16.2::el8
 before 1:15.6.1-2.20230906144858.el8ost
1:15.6.1-2.20230906144858.el8ost
openstack-glance
Red Hat:openstack:16.2::el8
 before 1:19.0.5-2.20230310205021.el8ost
1:19.0.5-2.20230310205021.el8ost
openstack-nova
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-api
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-common
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-compute
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-conductor
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-console
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-migration
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-novncproxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-scheduler
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-serialproxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
python3-cinder
Red Hat:openstack:16.2::el8
 before 1:15.6.1-2.20230906144858.el8ost
1:15.6.1-2.20230906144858.el8ost
python3-glance
Red Hat:openstack:16.2::el8
 before 1:19.0.5-2.20230310205021.el8ost
1:19.0.5-2.20230310205021.el8ost
python3-nova
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165228.el8ost
1:20.6.2-2.20230814165228.el8ost
openstack-nova
Red Hat:openstack:17.1::el8
 before 1:23.2.3-17.1.20231018123754.el8ost
1:23.2.3-17.1.20231018123754.el8ost
openstack-nova-common
Red Hat:openstack:17.1::el8
 before 1:23.2.3-17.1.20231018123754.el8ost
1:23.2.3-17.1.20231018123754.el8ost
openstack-nova-compute
Red Hat:openstack:17.1::el8
 before 1:23.2.3-17.1.20231018123754.el8ost
1:23.2.3-17.1.20231018123754.el8ost
openstack-nova-migration
Red Hat:openstack:17.1::el8
 before 1:23.2.3-17.1.20231018123754.el8ost
1:23.2.3-17.1.20231018123754.el8ost
python3-nova
Red Hat:openstack:17.1::el8
 before 1:23.2.3-17.1.20231018123754.el8ost
1:23.2.3-17.1.20231018123754.el8ost
openstack-cinder
Red Hat:openstack:16.1::el8
 before 1:15.4.0-1.20230510003503.el8ost
1:15.4.0-1.20230510003503.el8ost
openstack-glance
Red Hat:openstack:16.1::el8
 before 1:19.0.4-1.20230310213451.el8ost
1:19.0.4-1.20230310213451.el8ost
openstack-nova
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-api
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-common
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-compute
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-conductor
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-console
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-migration
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-novncproxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-scheduler
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-serialproxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
python3-cinder
Red Hat:openstack:16.1::el8
 before 1:15.4.0-1.20230510003503.el8ost
1:15.4.0-1.20230510003503.el8ost
python3-glance
Red Hat:openstack:16.1::el8
 before 1:19.0.4-1.20230310213451.el8ost
1:19.0.4-1.20230310213451.el8ost
python3-nova
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193234.el8ost
1:20.4.1-1.20221005193234.el8ost
glance
Ubuntu:Pro:16.04:LTS
 before 2:12.0.0-0ubuntu2+esm1, plus listed versions
2:11.0.0-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu12:12.0.0~rc1-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu2
2:12.0.0-0ubuntu2+esm1
cinder
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu12:8.0.0~b2-0ubuntu22:8.0.0~b3-0ubuntu22:8.0.0~rc1-0ubuntu2
Show 4 moreShow less
2:8.0.0-0ubuntu12:8.1.0-0ubuntu12:8.1.1-0ubuntu12:8.1.1-0ubuntu3
 None known
nova
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:12.0.0-0ubuntu22:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1
Show 19 moreShow less
2:13.0.0~rc3-0ubuntu12:13.0.0-0ubuntu12:13.0.0-0ubuntu22:13.0.0-0ubuntu52:13.1.0-0ubuntu12:13.1.1-0ubuntu12:13.1.1-0ubuntu1.12:13.1.2-0ubuntu22:13.1.3-0ubuntu12:13.1.3-0ubuntu22:13.1.4-0ubuntu12:13.1.4-0ubuntu22:13.1.4-0ubuntu32:13.1.4-0ubuntu4.12:13.1.4-0ubuntu4.22:13.1.4-0ubuntu4.32:13.1.4-0ubuntu4.42:13.1.4-0ubuntu4.52:13.1.4-0ubuntu4.5+esm1
 None known
cinder
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:11.0.0-0ubuntu22:11.0.0-0ubuntu32:12.0.0~b1-0ubuntu12:12.0.0~b2-0ubuntu22:12.0.0~rc1-0ubuntu1
Show 14 moreShow less
2:12.0.0~rc2-0ubuntu12:12.0.0~rc2-0ubuntu22:12.0.0-0ubuntu12:12.0.1-0ubuntu12:12.0.3-0ubuntu12:12.0.4-0ubuntu12:12.0.5-0ubuntu12:12.0.7-0ubuntu22:12.0.9-0ubuntu12:12.0.9-0ubuntu1.22:12.0.10-0ubuntu12:12.0.10-0ubuntu22:12.0.10-0ubuntu2.22:12.0.10-0ubuntu2.2+esm1
 None known
glance
Ubuntu:Pro:18.04:LTS
 before 2:16.0.1-0ubuntu1.1+esm2, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b2-0ubuntu22:16.0.0~rc1-0ubuntu12:16.0.0~rc2-0ubuntu12:16.0.0~rc3-0ubuntu12:16.0.0-0ubuntu12:16.0.1-0ubuntu1.1
2:16.0.1-0ubuntu1.1+esm2
nova
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:16.0.1-0ubuntu12:16.0.1-0ubuntu22:17.0.0~b1-0ubuntu12:17.0.0~b2-0ubuntu22:17.0.0~b3-0ubuntu3
Show 28 moreShow less
2:17.0.0~b3-0ubuntu42:17.0.0~rc1-0ubuntu12:17.0.0~rc2-0ubuntu12:17.0.0~rc3-0ubuntu12:17.0.0-0ubuntu12:17.0.1-0ubuntu12:17.0.3-0ubuntu12:17.0.4-0ubuntu12:17.0.5-0ubuntu12:17.0.5-0ubuntu22:17.0.6-0ubuntu12:17.0.7-0ubuntu12:17.0.7-0ubuntu22:17.0.9-0ubuntu12:17.0.9-0ubuntu32:17.0.10-0ubuntu22:17.0.10-0ubuntu2.12:17.0.11-0ubuntu12:17.0.12-0ubuntu12:17.0.13-0ubuntu12:17.0.13-0ubuntu22:17.0.13-0ubuntu32:17.0.13-0ubuntu42:17.0.13-0ubuntu52:17.0.13-0ubuntu5.22:17.0.13-0ubuntu5.32:17.0.13-0ubuntu5.42:17.0.13-0ubuntu5.4+esm1
 None known
cinder
Ubuntu:20.04:LTS
 before 2:16.4.2-0ubuntu2.8, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu12:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu12:16.0.0~b3~git2020041012.eb915e2db-0ubuntu12:16.0.0-0ubuntu0.20.04.1
Show 14 moreShow less
2:16.1.0-0ubuntu12:16.2.0-0ubuntu12:16.2.1-0ubuntu12:16.2.1-0ubuntu22:16.3.0-0ubuntu12:16.4.0-0ubuntu12:16.4.1-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu2.12:16.4.2-0ubuntu2.22:16.4.2-0ubuntu2.32:16.4.2-0ubuntu2.42:16.4.2-0ubuntu2.52:16.4.2-0ubuntu2.6
2:16.4.2-0ubuntu2.8
glance
Ubuntu:20.04:LTS
 before 2:20.2.0-0ubuntu1.2, plus listed versions
2:19.0.0-0ubuntu12:20.0.0~b1~git2019121610.0c6dd98d-0ubuntu12:20.0.0~b2~git2020020509.8649fdc2-0ubuntu12:20.0.0~b3~git2020032414.30ece7aa-0ubuntu22:20.0.0~b3~git2020041012.d5a0ce18-0ubuntu1
Show 5 moreShow less
2:20.0.0-0ubuntu0.20.04.12:20.0.1-0ubuntu12:20.1.0-0ubuntu12:20.2.0-0ubuntu12:20.2.0-0ubuntu1.1
2:20.2.0-0ubuntu1.2
nova
Ubuntu:20.04:LTS
 before 2:21.2.4-0ubuntu2.8, plus listed versions
2:20.0.0-0ubuntu12:21.0.0~b1~git2019120415.45fb747c98-0ubuntu12:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu22:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu42:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5
Show 18 moreShow less
2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu22:21.0.0-0ubuntu0.20.04.12:21.0.0-0ubuntu0.20.04.22:21.1.0-0ubuntu12:21.1.1-0ubuntu22:21.1.2-0ubuntu12:21.2.0-0ubuntu12:21.2.1-0ubuntu12:21.2.2-0ubuntu12:21.2.3-0ubuntu12:21.2.4-0ubuntu12:21.2.4-0ubuntu22:21.2.4-0ubuntu2.12:21.2.4-0ubuntu2.22:21.2.4-0ubuntu2.32:21.2.4-0ubuntu2.42:21.2.4-0ubuntu2.52:21.2.4-0ubuntu2.6
2:21.2.4-0ubuntu2.8
cinder
Ubuntu:22.04:LTS
 before 2:20.3.1-0ubuntu1.4, plus listed versions
2:19.0.0-0ubuntu22:19.0.0+git2022030310.b49fb59a6-0ubuntu12:19.0.0+git2022030310.b49fb59a6-0ubuntu22:20.0.0-0ubuntu12:20.0.1-0ubuntu1
Show 9 moreShow less
2:20.1.0-0ubuntu12:20.1.0-0ubuntu2.12:20.1.0-0ubuntu2.22:20.2.0-0ubuntu12:20.2.0-0ubuntu1.12:20.3.0-0ubuntu12:20.3.1-0ubuntu12:20.3.1-0ubuntu1.12:20.3.1-0ubuntu1.2
2:20.3.1-0ubuntu1.4
glance
Ubuntu:22.04:LTS
 before 2:24.2.1-0ubuntu1.2, plus listed versions
2:23.0.0-0ubuntu12:23.0.0+git2021120811.4ee7799aa-0ubuntu12:23.0.0+git2022011216.502fa0ffc-0ubuntu12:24.0.0~rc1+git2022030311.d4119be05-0ubuntu12:24.0.0-0ubuntu1
Show 4 moreShow less
2:24.1.0-0ubuntu12:24.1.0-0ubuntu1.12:24.2.0-0ubuntu12:24.2.1-0ubuntu1
2:24.2.1-0ubuntu1.2
nova
Ubuntu:22.04:LTS
 before 3:25.2.1-0ubuntu2.3, plus listed versions
3:24.0.0-0ubuntu13:24.0.0+git2022030310.3f274c65cc-0ubuntu23:25.0.0-0ubuntu13:25.0.0-0ubuntu1.13:25.0.1-0ubuntu1
Show 9 moreShow less
3:25.1.0-0ubuntu13:25.1.0-0ubuntu23:25.1.0-0ubuntu2.13:25.1.0-0ubuntu2.23:25.1.1-0ubuntu13:25.1.1-0ubuntu1.13:25.2.0-0ubuntu13:25.2.1-0ubuntu13:25.2.1-0ubuntu2
3:25.2.1-0ubuntu2.3
cinder
Ubuntu:24.04:LTS
 before 2:24.0.0-0ubuntu1.2, plus listed versions
2:23.0.0-0ubuntu12:23.0.0-0ubuntu32:23.0.0+git2024011915.b8cd101f-0ubuntu12:23.0.0+git2024011915.b8cd101f-0ubuntu22:24.0.0~rc1-0ubuntu12:24.0.0-0ubuntu1
2:24.0.0-0ubuntu1.2
glance
Ubuntu:24.04:LTS
 before 2:28.0.1-0ubuntu1.2, plus listed versions
2:27.0.0-0ubuntu12:28.0.0~b2+git2024011916.f429b53e-0ubuntu12:28.0.0~rc1-0ubuntu12:28.0.1-0ubuntu1
2:28.0.1-0ubuntu1.2
nova
Ubuntu:24.04:LTS
 before 3:29.0.1-0ubuntu1.3, plus listed versions
3:28.0.0-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu23:29.0.0~rc1-0ubuntu23:29.0.1-0ubuntu1
3:29.0.1-0ubuntu1.3
cinder
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 2:16.4.2-0ubuntu2.9, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu12:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu12:16.0.0~b3~git2020041012.eb915e2db-0ubuntu12:16.0.0-0ubuntu0.20.04.1
Show 15 moreShow less
2:16.1.0-0ubuntu12:16.2.0-0ubuntu12:16.2.1-0ubuntu12:16.2.1-0ubuntu22:16.3.0-0ubuntu12:16.4.0-0ubuntu12:16.4.1-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu2.12:16.4.2-0ubuntu2.22:16.4.2-0ubuntu2.32:16.4.2-0ubuntu2.42:16.4.2-0ubuntu2.52:16.4.2-0ubuntu2.62:16.4.2-0ubuntu2.8
2:16.4.2-0ubuntu2.9
cinder
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2:20.3.1-0ubuntu1.5, plus listed versions
2:19.0.0-0ubuntu22:19.0.0+git2022030310.b49fb59a6-0ubuntu12:19.0.0+git2022030310.b49fb59a6-0ubuntu22:20.0.0-0ubuntu12:20.0.1-0ubuntu1
Show 10 moreShow less
2:20.1.0-0ubuntu12:20.1.0-0ubuntu2.12:20.1.0-0ubuntu2.22:20.2.0-0ubuntu12:20.2.0-0ubuntu1.12:20.3.0-0ubuntu12:20.3.1-0ubuntu12:20.3.1-0ubuntu1.12:20.3.1-0ubuntu1.22:20.3.1-0ubuntu1.4
2:20.3.1-0ubuntu1.5
cinder
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 2:24.0.0-0ubuntu1.3, plus listed versions
2:23.0.0-0ubuntu12:23.0.0-0ubuntu32:23.0.0+git2024011915.b8cd101f-0ubuntu12:23.0.0+git2024011915.b8cd101f-0ubuntu22:24.0.0~rc1-0ubuntu12:24.0.0-0ubuntu12:24.0.0-0ubuntu1.2
2:24.0.0-0ubuntu1.3
glance
Ubuntu:Pro:20.04:LTS
 before 2:20.2.0-0ubuntu1.2+esm2, plus listed versions
2:19.0.0-0ubuntu12:20.0.0~b1~git2019121610.0c6dd98d-0ubuntu12:20.0.0~b2~git2020020509.8649fdc2-0ubuntu12:20.0.0~b3~git2020032414.30ece7aa-0ubuntu22:20.0.0~b3~git2020041012.d5a0ce18-0ubuntu1
Show 6 moreShow less
2:20.0.0-0ubuntu0.20.04.12:20.0.1-0ubuntu12:20.1.0-0ubuntu12:20.2.0-0ubuntu12:20.2.0-0ubuntu1.12:20.2.0-0ubuntu1.2
2:20.2.0-0ubuntu1.2+esm2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-32498 is a medium vulnerability (CVSS 6.5) in Openstack Cinder, published July 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in cinder 2:21.3.1-1~deb12u1.

References

Show 35 moreShow less
This page doesn't list everything

Left out here: 141 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open