[USN-6911-1] Nova vulnerability
Marc Deslauriers
marc.deslauriers at canonical.com
Tue Jul 23 19:15:06 UTC 2024
==========================================================================
Ubuntu Security Notice USN-6911-1
July 23, 2024
nova vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Nova would allow unintended access to files over the network.
Software Description:
- nova: OpenStack Compute cloud infrastructure
Details:
Arnaud Morin discovered that Nova incorrectly handled certain raw format
images. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
nova-common 3:29.0.1-0ubuntu1.4
python3-nova 3:29.0.1-0ubuntu1.4
Ubuntu 22.04 LTS
nova-common 3:25.2.1-0ubuntu2.6
python3-nova 3:25.2.1-0ubuntu2.6
Ubuntu 20.04 LTS
nova-common 2:21.2.4-0ubuntu2.11
python3-nova 2:21.2.4-0ubuntu2.11
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6911-1
CVE-2024-40767
Package Information:
https://launchpad.net/ubuntu/+source/nova/3:29.0.1-0ubuntu1.4
https://launchpad.net/ubuntu/+source/nova/3:25.2.1-0ubuntu2.6
https://launchpad.net/ubuntu/+source/nova/2:21.2.4-0ubuntu2.11
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240723/7cab983b/attachment-0001.sig>
More information about the ubuntu-security-announce
mailing list