-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 15 May 2023 09:36:50 +0200 Source: cinder Architecture: source Version: 2:17.4.0-1~deb11u2 Distribution: bullseye-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1035961 1074763 Changes: cinder (2:17.4.0-1~deb11u2) bullseye-security; urgency=medium . * CVE-2023-2088: Unauthorized volume access through deleted volume attachments. Applied upstream patch: Reject unsafe delete attachment calls (Closes: #1035961). * Above patch temporarily disabled until breackage is fixed. * Add add-params-thin_provisioning-equal-one.patch. * CVE-2024-32498: Arbitrary file access through custom QCOW2 external data. Add upstream patch (Closes: #1074763): - CVE-2024-32498_0_1_Use_the_json_format_output_of_qemu-img_info.patch - CVE-2024-32498_1_Check_for_external_qcow2_data_file.patch * Fix cinder-common.config.in reading glance_api_servers. * Build-depends on qemu-utils to be able to run additional tests. * (build-)depends on oslo.utils >= 4.6.1, needed for the CVE fix. * Correctly calls manage_glance_api_servers() in config script. Checksums-Sha1: e352fba084b1ac4cbf885e45a2cb45672c98d4b9 4468 cinder_17.4.0-1~deb11u2.dsc ee10e8f77ed52785352ce99e3c5108a9a3ab698f 3957656 cinder_17.4.0.orig.tar.xz a18bfdb99604ec722a0c009d8e2c5ee1947bc8d7 76716 cinder_17.4.0-1~deb11u2.debian.tar.xz 33e2308bbbea53d8dd4004a18709a6efabe5a890 19694 cinder_17.4.0-1~deb11u2_amd64.buildinfo Checksums-Sha256: 0106ba215b5b4ebf0e388b0d41ebf97a281f67af8c0be4665401b7c761a99d06 4468 cinder_17.4.0-1~deb11u2.dsc 60abbc0a151b7e3290883fbdb22fd599d4b6b3e53211b04572bcf4fc36648770 3957656 cinder_17.4.0.orig.tar.xz 9f7ebc030a58c7fa0f0feeb431fef285ec4db3704b2283cb6735c9dd8706e41c 76716 cinder_17.4.0-1~deb11u2.debian.tar.xz 3675fc3cfe15311f4ee1c12a979bb77ddad1792cbe770e33ec54e1b4abf48da9 19694 cinder_17.4.0-1~deb11u2_amd64.buildinfo Files: 988484e4dfb5fdbc6100257a03c7ce8d 4468 net optional cinder_17.4.0-1~deb11u2.dsc bcbc27523307b80af9f7ac971b03ad5c 3957656 net optional cinder_17.4.0.orig.tar.xz cd0964876011e9dcd8e8bc5b8e3a5313 76716 net optional cinder_17.4.0-1~deb11u2.debian.tar.xz a5cd72387a1f7ae139d2a675127c99fb 19694 net optional cinder_17.4.0-1~deb11u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmbYCRwACgkQ1BatFaxr Q/5iGg//f4Ptrl4hBR1quWPQNy54mC0+WrKhk3nus8mJ9g+OvrRU0pww5c+7nU1L TKfH/Ny7AUjTJvnJX9bl23TeJId9G4BUtPAJo1CXB0MPMQOpWVq/BC2mhmfscCo0 JOMOc1pERTLnK9wKmOZc7c3c337jHvj7yreQDZrK3BWYxEetTazb10VYMu4866cw Z6BHImC+Fx3F3PyRFkhh1r68gZRw48ft5DGbd1gUIMiyRZ28riix6/b880PGu3AH iAeD0iKhMxQBC8z+nWGEsF8X3ngXMF/3mdr/w3kZPAnL2ynLaOubT3CF22ppaMr1 ue5CfGt1Ea1WztSR08q9cCcP6J9e8I663uNCRSMWr7sIm+6xFrBf+mQOFKezkhoA gQ3j16EVBccx6Cc8gbZLDPFypWa+I3RJAADIAou8m3Dns9/Z1IXnrLZ2qIxFZ8p9 rZa9sctAcdx7a/319IDybDw2Vs1Awus1rlsjNqp3SiYOx0CC2bKx6xVQsfgXH/mN CwlZxAjsH6Uo5rWfUWsXdYSmgFacwR/5Tik/85Yn0miMPVhCXbUhx/Nm1PJvNCFJ pwVQ+UKKj7G1agmQ3IC9Adw1e1Z+K4aRplYi15KmLCtWGIfL1JSRwvnujfvjZSzD v+yg5JaZqP28+DmepT0/VuX8UP8G6b6OntlgsDtu/uF66q2N5Es= =Mqe/ -----END PGP SIGNATURE-----
