Vulnerability · Published May 12, 2023 · Assigned by redhat
CVE-2023-2088
Medium 6.5
In plain English
A medium-severity security flaw in OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.2%top 31.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cinder | 2:21.1.0-3 | DEBIAN-CVE-2023-2088 |
| Debian:13 | cinder | 2:21.1.0-3 | DEBIAN-CVE-2023-2088 |
| Debian:14 | cinder | 2:21.1.0-3 | DEBIAN-CVE-2023-2088 |
| Debian:12 | nova | 2:26.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:13 | nova | 2:26.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:14 | nova | 2:26.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:12 | python-glance-store | 4.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:13 | python-glance-store | 4.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:14 | python-glance-store | 4.1.0-4 | DEBIAN-CVE-2023-2088 |
| Debian:12 | python-os-brick | 4.1.0-3 | DEBIAN-CVE-2023-2088 |
| Debian:13 | python-os-brick | 4.1.0-3 | DEBIAN-CVE-2023-2088 |
| Debian:14 | python-os-brick | 4.1.0-3 | DEBIAN-CVE-2023-2088 |
| Ubuntu:22.04:LTS | cinder | 2:20.2.0-0ubuntu1.1 | USN-6241-1 |
| Ubuntu:22.04:LTS | cinder | 2:20.1.0-0ubuntu2.1 | USN-6073-1 |
| Ubuntu:22.04:LTS | cinder | 2:20.2.0-0ubuntu1.1 | UBUNTU-CVE-2023-2088 |
| Ubuntu:22.04:LTS | ironic | 1:20.1.0-0ubuntu1.1 | USN-6241-1 |
| Ubuntu:22.04:LTS | ironic | 1:20.1.0-0ubuntu1.1 | UBUNTU-CVE-2023-2088 |
| Ubuntu:22.04:LTS | nova | 3:25.1.0-0ubuntu2.1 | USN-6073-3 |
| Ubuntu:22.04:LTS | nova | 3:25.1.1-0ubuntu1.1 | USN-6241-1 |
| Ubuntu:22.04:LTS | nova | 3:25.1.1-0ubuntu1.1 | UBUNTU-CVE-2023-2088 |
| Ubuntu:22.04:LTS | python-glance-store | 3.0.0-0ubuntu1.1 | USN-6073-2 |
| Ubuntu:22.04:LTS | python-glance-store | 3.0.0-0ubuntu1.3 | USN-6241-1 |
| Ubuntu:22.04:LTS | python-glance-store | 3.0.0-0ubuntu1.3 | UBUNTU-CVE-2023-2088 |
| Ubuntu:22.04:LTS | python-os-brick | 5.2.2-0ubuntu1.2 | USN-6241-1 |
| Ubuntu:22.04:LTS | python-os-brick | 5.2.2-0ubuntu1.2 | UBUNTU-CVE-2023-2088 |
| Ubuntu:22.04:LTS | python-os-brick | 5.2.2-0ubuntu1 | USN-6073-4 |
Affected products (as reported)
Weakness: CWE-440 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N