Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 11 | nova | 2:22.4.0-1~deb11u7 |
Vulnerabilities 1
-
High 8.2
OpenStack Nova calls qemu-img without format restrictions for resize
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img withou…