Your message dated Tue, 20 Oct 2026 19:35:17 +0000
with message-id <[email protected]>
and subject line Bug#1151437: fixed in cinder 2:29.0.0-3
has caused the Debian Bug report #1151437,
regarding CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure
in Cinder Messages API
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151437: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151437
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: cinder
Version: 2:26.0.0-2
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-045.html
Date: October 20, 2026
CVE: CVE-2026-93856
Affects
~~~~~~~
- Cinder: >=9.0.0 <26.3.1, ==27.0.0, ==28.0.0, ==29.0.0
Description
~~~~~~~~~~~
Yuliang Xiao, an independent reporter, and Chen YuXiang of the
Institute of Computing Technology, Chinese Academy of Sciences
independently reported a vulnerability in Cinder's messages API.
A non-admin user with the project-scoped 'member' or 'reader' role
making the Block Storage API v3.3 "List messages" call finds the
non-expired user messages for other projects included in the
response, resulting in the leakage of UUIDs of resources owned by
other projects in addition to the user message about the other
projects' resources (which, by design, are sanitized generic
messages). All Cinder deployments are affected.
Patches
~~~~~~~
- https://review.opendev.org/1011490 (2025.1/epoxy)
- https://review.opendev.org/1011489 (2025.2/flamingo)
- https://review.opendev.org/1011488 (2026.1/gazpacho)
- https://review.opendev.org/1011487 (2026.2/hibiscus)
- https://review.opendev.org/1011486 (2027.1/indri (development))
Credits
~~~~~~~
- Yuliang Xiao (CVE-2026-93856)
- Chen YuXiang from Institute of Computing Technology, Chinese
Academy of Sciences (CVE-2026-93856)
References
~~~~~~~~~~
- https://launchpad.net/bugs/2160671
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93856
Notes
~~~~~
- Although the UUIDs of resources of other projects are leaked, a
project_id is not included in the response, so someone wishing to
exploit the leak must find an independent means of correlating each
resource ID with its associated project.
- The user messages API was introduced during the Newton development
cycle and first appeared in Cinder 9.0.0.
- The Cinder Contributor Guide contains more information about User
Messages:
https://docs.openstack.org/cinder/latest/contributor/user_messages.html
- Cinder user messages are controlled by the configuration options
``message_ttl`` (default: 30 days) and ``message_reap_interval``
(default: 24 hours).
--- End Message ---
--- Begin Message ---
Source: cinder
Source-Version: 2:29.0.0-3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cinder, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated cinder package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Oct 2026 20:04:15 +0200
Source: cinder
Architecture: source
Version: 2:29.0.0-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1151437
Changes:
cinder (2:29.0.0-3) unstable; urgency=high
.
* CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure
in the Cinder Messages API. Applied upstream patch "Fix cross-project
information disclosure in the messages API" (Closes: #1151437):
- CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch
Checksums-Sha1:
599e88cae4e41f452e3394ef89fb019aa60d41c3 4287 cinder_29.0.0-3.dsc
9b1f3a1b404a912b496f09be3a651ea77547bb46 48448 cinder_29.0.0-3.debian.tar.xz
03437760a06ecf90ba4730f1e6921d1d5ad78ff2 20383 cinder_29.0.0-3_amd64.buildinfo
Checksums-Sha256:
47a378ffcd45ba2efebc3800f90b1c11262efc2d4c99028e0c93e0208cb3aa21 4287
cinder_29.0.0-3.dsc
e2724ac775b7c985460d376ec6c04d12693fe631d59e639b2939ff4cd05613b7 48448
cinder_29.0.0-3.debian.tar.xz
b5e92879f62d73b599c7655a568fcb98b0533282fc4a4b8a979f527cb43c1c3f 20383
cinder_29.0.0-3_amd64.buildinfo
Files:
1e3bab5f39e8c5e20a89428e65edd2eb 4287 net optional cinder_29.0.0-3.dsc
e8e845d22f9f537d64cbefe687543a52 48448 net optional
cinder_29.0.0-3.debian.tar.xz
895a4481560fec2d36bb32e133810a66 20383 net optional
cinder_29.0.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrXvt0ACgkQ1BatFaxr
Q/7a3g/7BXZyHXwicNFFFHMrKWyjP3udfQJad1SkDpuv9vJWbc35lCaJDKqIzguQ
atf+g3fWSOcF8a8MogIQ/PNM0D3ciAmQBKpdk+pHiKM6I1FZNVB4cbzRKJJsKFg3
4yrPCev3mfNUkDb+FdA9tCbWFJvygju1QRlUfevo/RKn2B2Px180pQA+lAlMa3Lh
gTb4z8H9SM/AWw7PlDCVvbD87rdQvrGjR/VjE/S2bEhQm0+Ty/gNN3uK834pgFSj
NROCYvTC6z5GrcYB9Ow0lZNAcMJBGpmBuSvqZ5swO3B65Mb+wnovZ8pDIWek+jsM
Nq6vxrWY3PHLTtZkrxLCp2S/vFlzWFGloyHcynjdxXIbZKdOVwxxQHWFz7tjjaoR
RfJ4RUmaBaZwwpGweBgqDoFFI7TwffBKlVsxPQ6jMiYHEkNuyM5OkfajD56NQQx5
Njy3+dgYnNoGoNVihuwTCw/GvLIA3aR3edM76e9ASHXo+zMR+9oQBW0YFp7JMsJh
RWnUBYYkBTYL55iXx5iQaH6Xdx9LaLPLWsAzPc/yARNHciGGRvLdhpfD+8EmlI1s
X27qEKqV2cLhyJrxVzDzvL9JqGfpPSZM/wufNTLG3fCmZO+zyVZLaxVyLsqg6oBY
kizkG/6lnePdAPvZKeTP1Mi3YTGZkUJl38TvXJx0efjb0EqSk5c=
=t5EU
-----END PGP SIGNATURE-----
pgpQvg6c8Sl5L.pgp
Description: PGP signature
--- End Message ---
