CVE-2020-9543: OpenStack Manila Resource Manipulation
Summary
CVE-2020-9543: OpenStack Manila =8.0.0 =9.0.0. Affects manila across 3 version ranges.
< 7.4.1
>= 8.0.0, < 8.1.1
>= 9.0.0, < 9.1.1
Fixed in 7.4.1, 8.1.1 or 9.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- manila · Debian:11
The same CVE-2020-9543 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Manila is a shared file system service for OpenStack. It allows users to create and manage shared file systems and share networks. This vulnerability affects versions prior to 7.4.1, 8.0.0 to 8.1.1, and 9.0.0 to 9.1.1. The vulnerability allows attackers to view, update, delete, or share resources that do not belong to them. This is due to a context-free lookup of a UUID, which can be exploited to perform unauthorized actions on the affected system.
Vulnerability Detail
The vulnerability in OpenStack Manila arises from a context-free lookup of a UUID. Attackers can exploit this flaw to gain unauthorized access to resources and perform actions that they are not authorized to perform. This includes viewing, updating, deleting, or sharing resources that do not belong to them. Additionally, attackers can create resources such as shared file systems and groups of shares on affected share networks. The impact of this vulnerability can be significant, as it allows for unauthorized access and manipulation of sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.4.17.4.1pip install --upgrade "manila==7.4.1" -
>= 8.0.0, < 8.1.18.1.1pip install --upgrade "manila==8.1.1" -
>= 9.0.0, < 9.1.19.1.1pip install --upgrade "manila==9.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version as soon as possible.
Conclusion
OpenStack Manila versions prior to 7.4.1, 8.0.0 to 8.1.1, and 9.0.0 to 9.1.1 are vulnerable to unauthorized resource manipulation. Attackers can exploit a context-free lookup vulnerability to perform actions on resources that do not belong to them. It is crucial to upgrade to a fixed version of OpenStack Manila to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for manila →
FAQ
OpenStack Manila is a shared file system service for OpenStack. It allows users to create and manage shared file systems and share networks.
Versions prior to 7.4.1, 8.0.0 to 8.1.1, and 9.0.0 to 9.1.1 are affected by this vulnerability.
An attacker can view, update, delete, or share resources that do not belong to them. They can also create shared file systems and groups of shares on affected share networks.
No, there is no known workaround. It is recommended to upgrade to a fixed version of OpenStack Manila.
To fix this vulnerability, upgrade to version 7.4.1, 8.1.1, or 9.1.1 of OpenStack Manila.
Related vulnerabilities
Recent vulnerabilities recorded for manila.
