—

PYSEC-2013-35

Quick fix

PYSEC-2013-35 — cinder: upgrade to the fixed version with the command below.

pip install --upgrade 'cinder>=7.0.0a0'

Details

The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/cinder

Introduced in: 0Fixed in: 7.0.0a0

Fixpip install --upgrade 'cinder>=7.0.0a0'

References

http://rhn.redhat.com/errata/RHSA-2013-1198.html[ADVISORY]
https://bugs.launchpad.net/cinder/+bug/1198185[WEB]
http://www.ubuntu.com/usn/USN-2005-1[ADVISORY]