Description
The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2:13.0.0-1 | — |
| Debian 13 | nova | 2:13.0.0-1 | — |
| Debian 12 | nova | 2:13.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1.5-0ubuntu1.7 | USN-3449-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-nova +15 | 2015.1.2-18.2.el7ost | RHSA-2016:0363 |
| Red Hat OpenStack 6 | python-nova +14 | 2014.2.3-54.2.el7ost | RHSA-2016:0364 |
| Red Hat OpenStack 5 | python-nova +14 | 2014.1.5-29.el6ost | RHSA-2016:0366, RHSA-2016:0365 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 6 | openstack-ceilometer | 5.0.4~a0~dev6-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-ceilometer-doc | 5.0.4~a0~dev6-6.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-cinder +1 | 7.0.3~a0~dev2-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-dashboard | 8.0.2~a0~dev34-8.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-glance +1 | 11.0.2~a0~dev13-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-heat | 5.0.2~a0~dev93-9.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-heat-doc | 5.0.2~a0~dev93-9.3 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-keystone | 8.1.1~a0~dev13-3.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-keystone-doc | 8.1.1~a0~dev13-3.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-manila | 1.0.2~a0~dev11-9.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-manila-doc | 1.0.2~a0~dev11-9.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-neutron +1 | 7.1.2~a0~dev29-10.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-fwaas +3 | 7.1.2~a0~dev1-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-nova +1 | 12.0.5~a0~dev2-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-resource-agents | 1.0+git.1467079370.4f2c49d-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | python-networking-cisco | 2.1.1-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | python-openstackclient | 1.7.2-4.1 | SUSE-SU-2016:2143-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | >= 12.0.0, < 12.0.3 | 12.0.3 | GHSA-49jv-37hm-6gfp |
Advisories 6
- RHSA-2016:0366 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:0365 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:0363 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:0364 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- USN-3449-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:2143-1 Security update for several openstack-components SUSE / openSUSE Security Updates · Feb 4, 2026