Ubuntu 22.10, 22.04 LTS: 5835-3 Moderate Nova Info Exposure

ubuntu

January 31, 2023

Nova could be made to expose sensitive information.

Summary

Nova could be made to expose sensitive information.

Software Description:

- nova: OpenStack Compute cloud infrastructure

Details:

Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou

discovered that Nova incorrectly handled VMDK image processing. An

authenticated attacker could possibly supply a specially crafted VMDK flat

image and obtain arbitrary files from the server containing sensitive

information.

Topics Covered

security advisory software update information exposure ubuntu openstack nova sensitive data exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   nova-common                     3:26.1.0-0ubuntu1
   python3-nova                    3:26.1.0-0ubuntu1

Ubuntu 22.04 LTS:
   nova-common                     3:25.1.0-0ubuntu1
   python3-nova                    3:25.1.0-0ubuntu1

Ubuntu 20.04 LTS:
   nova-common                     2:21.2.4-0ubuntu2.1
   python3-nova                    2:21.2.4-0ubuntu2.1

In general, a standard system update will make all the necessary changes.