In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3873 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3873-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Thomas Goirand     September 05, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nova     Version        : 2:22.4.0-1~deb11u5     CVE ID         : CVE-2024-32498 CVE-2024-40767     Debian Bug     : 1074762

    Martin Kaesberger discovered a vulnerability which affects multiple     OpenStack components (Nova, Glance and Cinder): Malformed QCOW2 disk     images may result in the disclosure of arbitrary files.

    Arnaud Morin later discovered that the initial fix was not sufficient,     and that nova was still vulnerable with some VM images types.

    For Debian 11 bullseye, these problems have been fixed in version     2:22.4.0-1~deb11u5.

    We recommend that you upgrade your nova packages.

    For the detailed security status of nova please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nova

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5113 advisory.

    OpenStack Compute (codename Nova) is open source software designed     to provision and manage large networks of virtual machines,creating a     redundant and scalable cloud computing platform. It gives you the software,     control panels, and APIs required to orchestrate a cloud, including running     instances, managing networks, and controlling access through users and     projects.OpenStack Compute strives to be both hardware and hypervisor     agnostic, currently supporting a variety of standard hardware     configurations and seven major hypervisors.

    Security Fix(es):

    * Regression VMDK/qcow arbitrary file access (CVE-2024-40767)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5097 advisory.

    Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or     public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5083 advisory.

    Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or     public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6911-1 advisory.

    Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user     could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206639	Debian dla-3873 : nova-api - security update	Nessus	Debian Local Security Checks	medium
205194	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (openstack-nova) (RHSA-2024:5113)	Nessus	Red Hat Local Security Checks	medium
205161	RHEL 8 : Red Hat OpenStack Platform 16.2.6 (RHSA-2024:5097)	Nessus	Red Hat Local Security Checks	medium
205151	RHEL 9 : Red Hat OpenStack Platform 17.1.3 (RHSA-2024:5083)	Nessus	Red Hat Local Security Checks	medium
203691	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Nova vulnerability (USN-6911-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-40767

medium

Tenable Plugins

medium

medium

medium

medium

medium