Approved changes feed: RSS · Atom
cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Openstack (7b0cf974-b2b5-592e-bdf4-6953805ef02a) |
|---|---|
| Product | Cinder (3623b637-0ea9-5888-89ea-2ab9a4550392) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/cinder |
purl2cpe | 2026-06-01 10:17:02.649862 |
pkg:deb/ubuntu/cinder |
purl2cpe | 2026-06-01 10:17:02.649864 |
pkg:docker/openstackhelm/cinder |
purl2cpe | 2026-06-01 10:17:02.649865 |
pkg:github/openstack/cinder |
purl2cpe | 2026-06-01 10:17:02.649867 |
pkg:pypi/cinder |
purl2cpe | 2026-06-01 10:17:02.649868 |
pkg:rpm/opensuse/openstack-cinder |
purl2cpe | 2026-06-01 10:17:02.649870 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-32498 |
vulnerable | 2026-06-08 06:35:33.225272 |
Details available
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
Published: 2024-07-05T00:00:00.000Z
Updated: 2025-11-04T16:12:13.552Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47951 |
vulnerable | 2026-06-08 05:50:41.015129 |
Details available
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Published: 2023-01-26T00:00:00.000Z
Updated: 2025-03-31T16:49:31.493Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-7231 |
vulnerable | 2026-06-08 05:05:59.033301 |
Details available
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
Published: 2014-10-08T19:00:00.000Z
Updated: 2024-08-06T12:40:19.265Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-7230 |
vulnerable | 2026-06-08 05:05:59.030875 |
Details available
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
Published: 2014-10-08T19:00:00.000Z
Updated: 2024-08-06T12:40:19.269Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3641 |
vulnerable | 2026-06-08 05:05:42.009659 |
Details available
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
Published: 2014-10-08T19:00:00.000Z
Updated: 2024-08-06T10:50:17.930Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-4202 |
vulnerable | 2026-06-08 05:04:34.546381 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.