From 0cc7019eec2b58f507905d52370a74eb80613b99 Mon Sep 17 00:00:00 2001 From: Brian Rosmaita Date: Wed, 7 Jun 2023 18:29:20 -0400 Subject: [PATCH] [stable-em-only] Add CVE-2023-2088 warning The Cinder project team does not intend to backport a fix for CVE-2023-2088 to stable/train, so add a warning to the README so that consumers are aware of the vulnerability of this branch of the os-brick code. Change-Id: I6d04c164521b72538665f53ab62250b14b2710fe Related-bug: #2004555 --- README.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.rst b/README.rst index f3a9f8c4b..afd187607 100644 --- a/README.rst +++ b/README.rst @@ -21,6 +21,21 @@ brick OpenStack Cinder brick library for managing local volume attaches +.. warning:: + The stable/train branch of os-brick does not contain a fix for + CVE-2023-2088_. Be aware that such a fix must span cinder, os-brick, + nova, and, depending on your deployment configuration, glance_store + and ironic. *The Cinder project team advises against using the code + in this branch unless a mitigation against CVE-2023-2088 is applied.* + + .. _CVE-2023-2088: https://nvd.nist.gov/vuln/detail/CVE-2023-2088 + + References: + + * https://nvd.nist.gov/vuln/detail/CVE-2023-2088 + * https://bugs.launchpad.net/cinder/+bug/2004555 + * https://security.openstack.org/ossa/OSSA-2023-003.html + * https://wiki.openstack.org/wiki/OSSN/OSSN-0092 Features --------