8.2
Élevée
CVE-2026-24708 An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1
Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenStack Services on OpenShift 18.0 | Versions non publiées | |
| Red Hat OpenStack Platform 13 (Queens) | Versions non publiées | |
| Red Hat OpenStack Platform 16.2 | Versions non publiées | |
| Red Hat OpenStack Platform 17.1 | Versions non publiées | |
| Red Hat OpenStack Platform 18.0 | Versions non publiées | |
| Nova 32.0 | 32.0.0 → < 32.1.1 | 32.1.1 |
| Nova 31.0 | 31.0.0 → < 31.2.1 | 31.2.1 |
| Nova 30.2 | premières → < 30.2.2 | 30.2.2 |
| Red Hat OpenStack Platform 17.1 for RHEL 9 | Versions non publiées |
Références
- bugs.launchpad.net bugs.launchpad.net
- www.openwall.com www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenStack Services on OpenShift 18.0
Les 14 CVE de Red Hat OpenStack Services on OpenShift 18.0 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-42790
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS…
7.6
Élevée
CVE-2026-42789
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module)…
7.0
Élevée
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
Élevée