Every CVE Search/ Get API key

CVE-2024-40767

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

6.5 MediumFix available

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.95%Up 0.9 points since Jul 24, 2024
90%50%10%1%

What each source reports

NVD Score used 6.5

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
CVE-2024-40767
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-552
Updated
2026-11-02
CVE List 6.5

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
CVE-2024-40767
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-552
Updated
2026-11-02
EUVDEUVD-2024-2412 6.5

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
EUVD-2024-2412
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rm86-h44c-2r2m 5.3

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
GHSA-rm86-h44c-2r2m
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-436, CWE-552
Updated
2026-11-02
OSVGHSA-rm86-h44c-2r2m 5.3

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
GHSA-rm86-h44c-2r2m
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-436, CWE-552
Updated
2026-11-02
OSVPYSEC-2026-1709 5.3

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
PYSEC-2026-1709
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2024:5083 5.5

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.3 security update

Record
RHSA-2024:5083
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:5097 5.5

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.6 security update

Record
RHSA-2024:5097
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:5113 5.5

Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-nova) security update

Record
RHSA-2024:5113
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-40767 6.5

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Record
UBUNTU-CVE-2024-40767
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUSN-6911-1 No score

nova vulnerability

Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information.

Record
USN-6911-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
 through 27.4.0 None known
nova
PyPI
 28.0.0 to 28.2.0 None known
nova
PyPI
 29.0.0 to 29.1.0 None known
nova
PyPI
 through 27.4.0, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
 None known
nova
PyPI
 28.0.0 to 28.2.0, plus listed versions
28.0.128.1.0
 None known
nova
PyPI
 29.0.0 to 29.1.0, plus listed versions
29.0.129.0.2
 None known
nova
PyPI
 through 27.4.0, 28.0.0 to 28.2.0, 29.0.0 to 29.1.0, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
 None known
openstack-nova
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-api
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-common
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
Show 37 moreShow less
Affected packages
PackageAffectedFixed
openstack-nova-compute
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-conductor
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-migration
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-novncproxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-scheduler
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-serialproxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
python3-nova
Red Hat:openstack:17.1::el9
 before 1:23.2.3-17.1.20231018130829.el9ost
1:23.2.3-17.1.20231018130829.el9ost
openstack-nova
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-api
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-common
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-compute
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-conductor
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-console
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-migration
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-novncproxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-scheduler
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-serialproxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
python3-nova
Red Hat:openstack:16.2::el8
 before 1:20.6.2-2.20230814165229.el8ost
1:20.6.2-2.20230814165229.el8ost
openstack-nova
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-api
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-common
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-compute
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-conductor
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-console
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-migration
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-novncproxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-scheduler
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-serialproxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
openstack-nova-spicehtml5proxy
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
python3-nova
Red Hat:openstack:16.1::el8
 before 1:20.4.1-1.20221005193235.el8ost
1:20.4.1-1.20221005193235.el8ost
nova
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:12.0.0-0ubuntu22:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1
Show 19 moreShow less
2:13.0.0~rc3-0ubuntu12:13.0.0-0ubuntu12:13.0.0-0ubuntu22:13.0.0-0ubuntu52:13.1.0-0ubuntu12:13.1.1-0ubuntu12:13.1.1-0ubuntu1.12:13.1.2-0ubuntu22:13.1.3-0ubuntu12:13.1.3-0ubuntu22:13.1.4-0ubuntu12:13.1.4-0ubuntu22:13.1.4-0ubuntu32:13.1.4-0ubuntu4.12:13.1.4-0ubuntu4.22:13.1.4-0ubuntu4.32:13.1.4-0ubuntu4.42:13.1.4-0ubuntu4.52:13.1.4-0ubuntu4.5+esm1
 None known
nova
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:16.0.1-0ubuntu12:16.0.1-0ubuntu22:17.0.0~b1-0ubuntu12:17.0.0~b2-0ubuntu22:17.0.0~b3-0ubuntu3
Show 28 moreShow less
2:17.0.0~b3-0ubuntu42:17.0.0~rc1-0ubuntu12:17.0.0~rc2-0ubuntu12:17.0.0~rc3-0ubuntu12:17.0.0-0ubuntu12:17.0.1-0ubuntu12:17.0.3-0ubuntu12:17.0.4-0ubuntu12:17.0.5-0ubuntu12:17.0.5-0ubuntu22:17.0.6-0ubuntu12:17.0.7-0ubuntu12:17.0.7-0ubuntu22:17.0.9-0ubuntu12:17.0.9-0ubuntu32:17.0.10-0ubuntu22:17.0.10-0ubuntu2.12:17.0.11-0ubuntu12:17.0.12-0ubuntu12:17.0.13-0ubuntu12:17.0.13-0ubuntu22:17.0.13-0ubuntu32:17.0.13-0ubuntu42:17.0.13-0ubuntu52:17.0.13-0ubuntu5.22:17.0.13-0ubuntu5.32:17.0.13-0ubuntu5.42:17.0.13-0ubuntu5.4+esm1
 None known
nova
Ubuntu:20.04:LTS
 before 2:21.2.4-0ubuntu2.11, plus listed versions
2:20.0.0-0ubuntu12:21.0.0~b1~git2019120415.45fb747c98-0ubuntu12:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu22:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu42:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5
Show 19 moreShow less
2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu22:21.0.0-0ubuntu0.20.04.12:21.0.0-0ubuntu0.20.04.22:21.1.0-0ubuntu12:21.1.1-0ubuntu22:21.1.2-0ubuntu12:21.2.0-0ubuntu12:21.2.1-0ubuntu12:21.2.2-0ubuntu12:21.2.3-0ubuntu12:21.2.4-0ubuntu12:21.2.4-0ubuntu22:21.2.4-0ubuntu2.12:21.2.4-0ubuntu2.22:21.2.4-0ubuntu2.32:21.2.4-0ubuntu2.42:21.2.4-0ubuntu2.52:21.2.4-0ubuntu2.62:21.2.4-0ubuntu2.8
2:21.2.4-0ubuntu2.11
nova
Ubuntu:22.04:LTS
 before 3:25.2.1-0ubuntu2.6, plus listed versions
3:24.0.0-0ubuntu13:24.0.0+git2022030310.3f274c65cc-0ubuntu23:25.0.0-0ubuntu13:25.0.0-0ubuntu1.13:25.0.1-0ubuntu1
Show 10 moreShow less
3:25.1.0-0ubuntu13:25.1.0-0ubuntu23:25.1.0-0ubuntu2.13:25.1.0-0ubuntu2.23:25.1.1-0ubuntu13:25.1.1-0ubuntu1.13:25.2.0-0ubuntu13:25.2.1-0ubuntu13:25.2.1-0ubuntu23:25.2.1-0ubuntu2.3
3:25.2.1-0ubuntu2.6
nova
Ubuntu:24.04:LTS
 before 3:29.0.1-0ubuntu1.4, plus listed versions
3:28.0.0-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu13:28.0.1+git2024011916.087c372a-0ubuntu23:29.0.0~rc1-0ubuntu23:29.0.1-0ubuntu13:29.0.1-0ubuntu1.3
3:29.0.1-0ubuntu1.4

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-40767 is a medium vulnerability (CVSS 6.5) in Openstack Nova, published July 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in openstack-nova 1:23.2.3-17.1.20231018130829.el9ost.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: 106 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open