Debian Security Advisory
DSA-3292-1 cinder -- security update
- Date Reported:
- 19 Jun 2015
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 788996.
In Mitre's CVE dictionary: CVE-2015-1851.
- More information:
Bastian Blank from credativ discovered that cinder, a storage-as-a-service system for the OpenStack cloud computing suite, contained a bug that would allow an authenticated user to read any file from the cinder server.
For the stable distribution (jessie), this problem has been fixed in version 2014.1.3-11+deb8u1.
For the unstable distribution (sid), this problem has been fixed in version 2015.1.0+2015.06.16.git26.9634b76ba5-1.
We recommend that you upgrade your cinder packages.