—

PYSEC-2013-35

Details

The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / cinder

Introduced in: 0 Fixed in: 7.0.0a0

Fix pip install --upgrade 'cinder>=7.0.0a0'

References

http://rhn.redhat.com/errata/RHSA-2013-1198.html [ADVISORY]
https://bugs.launchpad.net/cinder/+bug/1198185 [WEB]
http://www.ubuntu.com/usn/USN-2005-1 [ADVISORY]