Ubuntu Security Notice 5835-5 - USN-5835-3 fixed vulnerabilities in Nova. This update provides the corresponding updates for Ubuntu 18.04 LTS. Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou discovered that Nova incorrectly handled VMDK image processing. An authenticated attacker could possibly supply a specially crafted VMDK flat image and obtain arbitrary files from the server containing sensitive information.
849be3ecfe24a5c1a9e3f943a68b92a32c8177e09081ae6b746734cd27ea46d0
==========================================================================
Ubuntu Security Notice USN-5835-5
February 09, 2023
nova vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Nova could be made to expose sensitive information.
Software Description:
- nova: OpenStack Compute cloud infrastructure
Details:
USN-5835-3 fixed vulnerabilities in Nova. This update provides the
corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Guillaume Espanel, Pierre Libeau, Arnaud Morin, and Damien Rannou
discovered that Nova incorrectly handled VMDK image processing. An
authenticated attacker could possibly supply a specially crafted VMDK flat
image and obtain arbitrary files from the server containing sensitive
information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
nova-common 2:17.0.13-0ubuntu5.2
python-nova 2:17.0.13-0ubuntu5.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5835-5
https://ubuntu.com/security/notices/USN-5835-1
CVE-2022-47951
Package Information:
https://launchpad.net/ubuntu/+source/nova/2:17.0.13-0ubuntu5.2