Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Debian · 12 | nova | 2:26.2.2-1~deb12u4 |
| Debian · 13 | nova | 2:31.0.0-6+deb13u2 |
Vulnerabilities 1
-
High 8.2
OpenStack Nova calls qemu-img without format restrictions for resize
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img withou…