CVE-2014-3641

OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

4.0 MediumFix available

CVE-2014-3641 is a medium vulnerability (CVSS 4.0) in Openstack Cinder, published October 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in cinder 2014.1.3.

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.

Exploit likelihood

1.88%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2014-3641
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-3641
Updated: 2026-11-02

EUVDEUVD-2022-4978 No score

Record: EUVD-2022-4978
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qhch-g8qr-p497 No score

OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Record: GHSA-qhch-g8qr-p497
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Record: CVE-2014-3641
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-3641 No score

Record: DEBIAN-CVE-2014-3641
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-qhch-g8qr-p497 No score

OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Record: GHSA-qhch-g8qr-p497
Weakness: CWE-200
Updated: 2026-11-02

OSVPYSEC-2026-791 No score

OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Record: PYSEC-2026-791
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-3641 No score

Record: UBUNTU-CVE-2014-3641
Updated: 2026-11-02

OSVUSN-2405-1 No score

cinder vulnerabilities

Duncan Thomas discovered that OpenStack Cinder did not properly track the file format when using the GlusterFS of Smbfs drivers. A remote authenticated user could exploit this to potentially obtain file contents from the compute host. (CVE-2014-3641)

Amrith Kumar discovered that OpenStack Cinder did not properly sanitize log message contents. Under certain circumstances, a local attacker with read access to Cinder log files could obtain access to sensitive information. (CVE-2014-7230)

Record: USN-2405-1
Updated: 2026-11-02

Affected products

openstack cinder

Affected packages

Affected packages
Package	Affected	Fixed
`cinder` PyPI	before 2014.1.3	2014.1.3
`cinder` Debian:12	before 2014.1.3-1	2014.1.3-1
`cinder` Debian:13	before 2014.1.3-1	2014.1.3-1
`cinder` Debian:14	before 2014.1.3-1	2014.1.3-1
`cinder` PyPI	before 2014.1.3, plus listed versions 10.0.811.2.011.2.111.2.212.0.10 Show 45 moreShow less 12.0.412.0.512.0.612.0.712.0.812.0.913.0.113.0.213.0.313.0.413.0.513.0.613.0.713.0.813.0.914.0.014.0.0.0rc114.0.0.0rc214.0.114.0.214.0.314.0.414.1.014.2.014.2.114.3.014.3.115.0.015.0.0.0rc115.0.0.0rc215.0.115.1.015.2.015.3.015.4.015.4.115.5.015.6.016.0.016.0.0.0b116.0.0.0rc116.0.0.0rc216.0.0.0rc316.1.016.2.0	2014.1.3
`openstack-cinder` Red Hat:openstack:5::el6	before 0:2014.1.3-1.el6ost	0:2014.1.3-1.el6ost
`openstack-cinder-doc` Red Hat:openstack:5::el6	before 0:2014.1.3-1.el6ost	0:2014.1.3-1.el6ost
`python-cinder` Red Hat:openstack:5::el6	before 0:2014.1.3-1.el6ost	0:2014.1.3-1.el6ost
`openstack-cinder` Red Hat:openstack:5::el7	before 0:2014.1.3-1.el7ost	0:2014.1.3-1.el7ost
`openstack-cinder-doc` Red Hat:openstack:5::el7	before 0:2014.1.3-1.el7ost	0:2014.1.3-1.el7ost
`python-cinder` Red Hat:openstack:5::el7	before 0:2014.1.3-1.el7ost	0:2014.1.3-1.el7ost
`cinder` Ubuntu:14.04:LTS	before 1:2014.1.3-0ubuntu1.1, plus listed versions 1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b1-0ubuntu21:2014.1~b2-0ubuntu1 Show 10 moreShow less 1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1~rc3-0ubuntu11:2014.1-0ubuntu11:2014.1-0ubuntu1.11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu11:2014.1.3-0ubuntu1	1:2014.1.3-0ubuntu1.1