{"id":"CVE-2016-2140","aliases":["DEBIAN-CVE-2016-2140","EUVD-2022-2346","GHSA-49jv-37hm-6gfp","PYSEC-2026-864","RHSA-2016:0363","RHSA-2016:0364","RHSA-2016:0365","RHSA-2016:0366","SUSE-SU-2016:2143-1","UBUNTU-CVE-2016-2140","USN-3449-1"],"status":"published","title":"OpenStack Nova host data access through resize/migration","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02108,"percentile":0.81892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-04-12T00:00:00Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"PyPI","package":"nova","fixed_in":["12.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nova","fixed_in":["2:13.0.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-api","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cells","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cert","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-common","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-compute","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-conductor","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-console","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-doc","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-network","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-novncproxy","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-objectstore","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-scheduler","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-serialproxy","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-spicehtml5proxy","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-nova","fixed_in":["0:2015.1.2-18.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-api","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-cells","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-cert","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-common","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-compute","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-conductor","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-console","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-doc","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-network","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-novncproxy","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-objectstore","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-scheduler","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-serialproxy","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-nova","fixed_in":["0:2014.2.3-54.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-api","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-cells","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-cert","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-common","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-compute","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-conductor","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-console","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-doc","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-network","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-novncproxy","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-objectstore","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-scheduler","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-serialproxy","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-nova","fixed_in":["0:2014.1.5-29.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-api","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-cells","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-cert","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-common","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-compute","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-conductor","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-console","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-doc","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-network","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-novncproxy","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-objectstore","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-scheduler","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-serialproxy","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-nova","fixed_in":["0:2014.1.5-29.el6ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nova","fixed_in":["1:2014.1.5-0ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.2-18.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-54.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-cells","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-cert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-objectstore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-29.el6ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4~a0~dev6-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-ceilometer-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4~a0~dev6-6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~a0~dev34-8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.2~a0~dev13-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.2~a0~dev13-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~a0~dev93-9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~a0~dev93-9.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1~a0~dev13-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1~a0~dev13-3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2~a0~dev11-9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-manila-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2~a0~dev11-9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev29-10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev29-10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-fwaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-fwaas-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-lbaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-lbaas-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1467079370.4f2c49d-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-networking-cisco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"],"bundled":7}],"products":[{"vendor":"openstack","product":"nova"}],"references":[{"url":"https://bugs.launchpad.net/nova/+bug/1548450","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2016-007.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/84277","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/08/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2140","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0363","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0364","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0365","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0366","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2140","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313454","tags":["web","report"]},{"url":"http://seclists.org/oss-sec/2016/q1/563","tags":["web","article"]},{"url":"https://github.com/openstack/nova/commit/0b194187db9da28225cb5e62be3b45aff5a1c793","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/116b1210ab772c55d1ed1f715687d83877c92701","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/f302bf04ab5dda89cf8ceaeed309006da90c0666","tags":["web"]},{"url":"https://github.com/advisories/GHSA-49jv-37hm-6gfp","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2140","tags":["advisory"]},{"url":"https://github.com/openstack/nova","tags":["package"]},{"url":"https://pypi.org/project/nova","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0363.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2140","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0364.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0365.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0366.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/970258","tags":["report"]},{"url":"https://bugzilla.suse.com/982426","tags":["report"]},{"url":"https://bugzilla.suse.com/983807","tags":["report"]},{"url":"https://bugzilla.suse.com/984442","tags":["report"]},{"url":"https://bugzilla.suse.com/984443","tags":["report"]},{"url":"https://bugzilla.suse.com/988729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5363","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2140","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q1/564","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3449-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8749","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2140","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T14:00:00Z","modified":"2024-08-05T23:17:50.583Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2022-2346","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T14:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.125931Z"}],"ghsa":[{"id":"GHSA-49jv-37hm-6gfp","title":"OpenStack Nova host data access through resize/migration","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2022-05-14T01:58:44Z","modified":"2024-05-14T21:13:55Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2016-2140","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T14:59:10.12Z","modified":"2026-06-17T00:43:31.107Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-2140","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T14:59:10.12Z","modified":"2026-10-24T10:30:18.025937503Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2140","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T14:59:10.12Z","modified":"2026-09-22T07:00:20.631175316Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-49jv-37hm-6gfp","title":"OpenStack Nova host data access through resize/migration","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2022-05-14T01:58:44Z","modified":"2026-07-07T11:56:36.613317656Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2026-864","title":"OpenStack Nova host data access through resize/migration","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2026-07-06T08:03:22.002134Z","modified":"2026-07-07T11:45:21.897882594Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2016-2140","description":"The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.","status":"published","published":"2016-04-12T00:00:00Z","modified":"2026-02-04T04:06:28.727385Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"RHSA-2016:0363","title":"Red Hat Security Advisory: openstack-nova security update","status":"published","published":"2024-09-13T11:31:14Z","modified":"2026-10-08T10:01:14Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0364","title":"Red Hat Security Advisory: openstack-nova security update","status":"published","published":"2024-09-13T11:31:18Z","modified":"2026-10-08T10:01:14Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0365","title":"Red Hat Security Advisory: openstack-nova security update","status":"published","published":"2024-09-13T11:31:23Z","modified":"2026-10-08T10:01:15Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0366","title":"Red Hat Security Advisory: openstack-nova security update","status":"published","published":"2024-09-13T11:31:26Z","modified":"2026-10-08T10:01:16Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:2143-1","title":"Security update for several openstack-components","description":"\nThis update provides the latest code from OpenStack Liberty for openstack-ceilometer, -cinder, \n-dashboard, -glance, -heat, -keystone, -manila, -neutron, -neutron-fwaas, -neutron-lbaas,-nova,\n-resource-agents, python-networking-cisco and python-openstackclient.\n\nAdditionally some security-issues have been fixed:\n\nopenstack-nova:\n\n- Always copy or recreate disk.info during a migration. (bsc#970258, CVE-2016-2140)\n\nopenstack-dashboard:\n\n- Escape anularjs templating in unsafe HTML. (bsc#983807, CVE-2016-4428)\n\nopenstack-neutron:\n\n- Fix bypassing of anti-spoof protection. (bsc#984443, CVE-2016-5363, bsc#984442, CVE-2016-5362)\n\nFor a detailed description of all fixes and improvements, please refer to the changelog.\n","status":"published","published":"2016-08-23T15:49:42Z","modified":"2026-02-04T02:53:18.835356Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3449-1","title":"nova vulnerabilities","description":"George Shuklin discovered that OpenStack Nova incorrectly handled the\nmigration process. A remote authenticated user could use this issue to\nconsume resources, resulting in a denial of service. (CVE-2015-3241)\n\nGeorge Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly\nhandled deleting instances. A remote authenticated user could use this\nissue to consume disk resources, resulting in a denial of service.\n(CVE-2015-3280)\n\nIt was discovered that OpenStack Nova incorrectly limited qemu-img calls. A\nremote authenticated user could use this issue to consume resources,\nresulting in a denial of service. (CVE-2015-5162)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled snapshots.\nA remote authenticated user could use this issue to read arbitrary files.\n(CVE-2015-7548)\n\nSreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied\nsecurity group changes. A remote attacker could possibly use this issue to\nbypass intended restriction changes by leveraging an instance that was\nrunning when the change was made. (CVE-2015-7713)\n\nMatt Riedemann discovered that OpenStack Nova incorrectly handled logging.\nA local attacker could possibly use this issue to obtain sensitive\ninformation from log files. (CVE-2015-8749)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled certain\nqcow2 headers. A remote authenticated user could possibly use this issue to\nread arbitrary files. (CVE-2016-2140)\n","status":"published","published":"2017-10-11T11:46:58Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}