Skip to content
OpenAdvisories
Medium USN-6884-1 1 CVE

nova vulnerability

Published Jul 8, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Martin Kaesberger discovered that Nova incorrectly handled QCOW2 image
processing. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS nova 2:21.2.4-0ubuntu2.8
Ubuntu · 22.04 LTS 22.04:LTS nova 3:25.2.1-0ubuntu2.3
Ubuntu · 24.04 LTS 24.04:LTS nova 3:29.0.1-0ubuntu1.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-32498

    OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenti…

    nova nova glance nova Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-32498