Skip to content
OpenAdvisories
Medium USN-6911-1 1 CVE

nova vulnerability

Published Jul 23, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Arnaud Morin discovered that Nova incorrectly handled certain raw format
images. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS nova 2:21.2.4-0ubuntu2.11
Ubuntu · 22.04 LTS 22.04:LTS nova 3:25.2.1-0ubuntu2.6
Ubuntu · 24.04 LTS 24.04:LTS nova 3:29.0.1-0ubuntu1.4

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-40767

    OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

    In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems…

    nova nova Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-40767