{"id":"CVE-2024-40767","aliases":["EUVD-2024-2412","GHSA-rm86-h44c-2r2m","PYSEC-2026-1709","RHSA-2024:5083","RHSA-2024:5097","RHSA-2024:5113","UBUNTU-CVE-2024-40767","USN-6911-1"],"status":"published","title":"OpenStack Nova vulnerable to unauthorized access to potentially sensitive data","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00949,"percentile":0.61519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436","CWE-552"],"published":"2024-07-23T15:00:00Z","modified":"2026-08-08T10:05:31Z","fixes":[{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-api","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-common","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-compute","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-conductor","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-migration","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-novncproxy","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-scheduler","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-serialproxy","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-spicehtml5proxy","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-nova","fixed_in":["1:23.2.3-17.1.20231018130829.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-api","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-common","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-compute","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-conductor","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-console","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-migration","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-novncproxy","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-scheduler","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-serialproxy","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-spicehtml5proxy","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-nova","fixed_in":["1:20.6.2-2.20230814165229.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-api","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-common","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-compute","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-conductor","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-console","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-migration","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-novncproxy","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-scheduler","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-serialproxy","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-spicehtml5proxy","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-nova","fixed_in":["1:20.4.1-1.20221005193235.el8ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nova","fixed_in":["2:21.2.4-0ubuntu2.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nova","fixed_in":["3:25.2.1-0ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nova","fixed_in":["3:29.0.1-0ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"27.4.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.0.0"},{"last_affected":"28.2.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0.0"},{"last_affected":"29.1.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"27.4.0"}]}],"versions":["15.1.5","16.1.6","16.1.7","16.1.8","17.0.10","17.0.11","17.0.12","17.0.13","17.0.7","17.0.8","17.0.9","18.0.2","18.0.3","18.1.0","18.2.0","18.2.1","18.2.2","18.2.3","18.3.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","19.0.3","19.1.0","19.2.0","19.3.0","19.3.1","19.3.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","20.1.0","20.1.1","20.2.0","20.3.0","20.4.0","20.4.1","20.5.0","20.6.0","20.6.1","21.0.0","21.0.0.0rc1","21.0.0.0rc2","21.1.0","21.1.1","21.1.2","21.2.0","21.2.1","21.2.2","21.2.3","21.2.4","22.0.0","22.0.0.0rc1","22.0.1","22.1.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","23.0.0","23.0.0.0rc1","23.0.0.0rc2","23.0.1","23.0.2","23.1.0","23.2.0","23.2.1","23.2.2","24.0.0","24.0.0.0rc1","24.0.0.0rc2","24.1.0","24.1.1","24.2.0","24.2.1","25.0.0","25.0.0.0rc1","25.0.1","25.1.0","25.1.1","25.2.0","25.2.1","25.3.0","26.0.0","26.0.0.0rc1","26.0.0.0rc2","26.1.0","26.1.1","26.2.0","26.2.1","26.2.2","26.3.0","27.0.0","27.0.0.0rc1","27.1.0","27.2.0","27.3.0","27.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.0.0"},{"last_affected":"28.2.0"}]}],"versions":["28.0.0","28.0.1","28.1.0","28.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0.0"},{"last_affected":"29.1.0"}]}],"versions":["29.0.0","29.0.1","29.0.2","29.1.0"]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"27.4.0"},{"introduced":"28.0.0"},{"last_affected":"28.2.0"},{"introduced":"29.0.0"},{"last_affected":"29.1.0"}]}],"versions":["15.1.5","16.1.6","16.1.7","16.1.8","17.0.10","17.0.11","17.0.12","17.0.13","17.0.7","17.0.8","17.0.9","18.0.2","18.0.3","18.1.0","18.2.0","18.2.1","18.2.2","18.2.3","18.3.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","19.0.3","19.1.0","19.2.0","19.3.0","19.3.1","19.3.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","20.1.0","20.1.1","20.2.0","20.3.0","20.4.0","20.4.1","20.5.0","20.6.0","20.6.1","21.0.0","21.0.0.0rc1","21.0.0.0rc2","21.1.0","21.1.1","21.1.2","21.2.0","21.2.1","21.2.2","21.2.3","21.2.4","22.0.0","22.0.0.0rc1","22.0.1","22.1.0","22.2.0","22.2.1","22.2.2","22.3.0","22.4.0","23.0.0","23.0.0.0rc1","23.0.0.0rc2","23.0.1","23.0.2","23.1.0","23.2.0","23.2.1","23.2.2","24.0.0","24.0.0.0rc1","24.0.0.0rc2","24.1.0","24.1.1","24.2.0","24.2.1","25.0.0","25.0.0.0rc1","25.0.1","25.1.0","25.1.1","25.2.0","25.2.1","25.3.0","26.0.0","26.0.0.0rc1","26.0.0.0rc2","26.1.0","26.1.1","26.2.0","26.2.1","26.2.2","26.3.0","27.0.0","27.0.0.0rc1","27.1.0","27.2.0","27.3.0","27.4.0","28.0.0","28.0.1","28.1.0","28.2.0","29.0.0","29.0.1","29.0.2","29.1.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:23.2.3-17.1.20231018130829.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.6.2-2.20230814165229.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-conductor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-novncproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-serialproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-nova-spicehtml5proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.4.1-1.20221005193235.el8ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:12.0.0-0ubuntu2","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc3-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.0-0ubuntu2","2:13.0.0-0ubuntu5","2:13.1.0-0ubuntu1","2:13.1.1-0ubuntu1","2:13.1.1-0ubuntu1.1","2:13.1.2-0ubuntu2","2:13.1.3-0ubuntu1","2:13.1.3-0ubuntu2","2:13.1.4-0ubuntu1","2:13.1.4-0ubuntu2","2:13.1.4-0ubuntu3","2:13.1.4-0ubuntu4.1","2:13.1.4-0ubuntu4.2","2:13.1.4-0ubuntu4.3","2:13.1.4-0ubuntu4.4","2:13.1.4-0ubuntu4.5","2:13.1.4-0ubuntu4.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:16.0.1-0ubuntu1","2:16.0.1-0ubuntu2","2:17.0.0~b1-0ubuntu1","2:17.0.0~b2-0ubuntu2","2:17.0.0~b3-0ubuntu3","2:17.0.0~b3-0ubuntu4","2:17.0.0~rc1-0ubuntu1","2:17.0.0~rc2-0ubuntu1","2:17.0.0~rc3-0ubuntu1","2:17.0.0-0ubuntu1","2:17.0.1-0ubuntu1","2:17.0.3-0ubuntu1","2:17.0.4-0ubuntu1","2:17.0.5-0ubuntu1","2:17.0.5-0ubuntu2","2:17.0.6-0ubuntu1","2:17.0.7-0ubuntu1","2:17.0.7-0ubuntu2","2:17.0.9-0ubuntu1","2:17.0.9-0ubuntu3","2:17.0.10-0ubuntu2","2:17.0.10-0ubuntu2.1","2:17.0.11-0ubuntu1","2:17.0.12-0ubuntu1","2:17.0.13-0ubuntu1","2:17.0.13-0ubuntu2","2:17.0.13-0ubuntu3","2:17.0.13-0ubuntu4","2:17.0.13-0ubuntu5","2:17.0.13-0ubuntu5.2","2:17.0.13-0ubuntu5.3","2:17.0.13-0ubuntu5.4","2:17.0.13-0ubuntu5.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.2.4-0ubuntu2.11"}]}],"versions":["2:20.0.0-0ubuntu1","2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5","2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2","2:21.0.0-0ubuntu0.20.04.1","2:21.0.0-0ubuntu0.20.04.2","2:21.1.0-0ubuntu1","2:21.1.1-0ubuntu2","2:21.1.2-0ubuntu1","2:21.2.0-0ubuntu1","2:21.2.1-0ubuntu1","2:21.2.2-0ubuntu1","2:21.2.3-0ubuntu1","2:21.2.4-0ubuntu1","2:21.2.4-0ubuntu2","2:21.2.4-0ubuntu2.1","2:21.2.4-0ubuntu2.2","2:21.2.4-0ubuntu2.3","2:21.2.4-0ubuntu2.4","2:21.2.4-0ubuntu2.5","2:21.2.4-0ubuntu2.6","2:21.2.4-0ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.2.1-0ubuntu2.6"}]}],"versions":["3:24.0.0-0ubuntu1","3:24.0.0+git2022030310.3f274c65cc-0ubuntu2","3:25.0.0-0ubuntu1","3:25.0.0-0ubuntu1.1","3:25.0.1-0ubuntu1","3:25.1.0-0ubuntu1","3:25.1.0-0ubuntu2","3:25.1.0-0ubuntu2.1","3:25.1.0-0ubuntu2.2","3:25.1.1-0ubuntu1","3:25.1.1-0ubuntu1.1","3:25.2.0-0ubuntu1","3:25.2.1-0ubuntu1","3:25.2.1-0ubuntu2","3:25.2.1-0ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:29.0.1-0ubuntu1.4"}]}],"versions":["3:28.0.0-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu2","3:29.0.0~rc1-0ubuntu2","3:29.0.1-0ubuntu1","3:29.0.1-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.2.4-0ubuntu2.11"}]}],"versions":["2:20.0.0-0ubuntu1","2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4","2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5","2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2","2:21.0.0-0ubuntu0.20.04.1","2:21.0.0-0ubuntu0.20.04.2","2:21.1.0-0ubuntu1","2:21.1.1-0ubuntu2","2:21.1.2-0ubuntu1","2:21.2.0-0ubuntu1","2:21.2.1-0ubuntu1","2:21.2.2-0ubuntu1","2:21.2.3-0ubuntu1","2:21.2.4-0ubuntu1","2:21.2.4-0ubuntu2","2:21.2.4-0ubuntu2.1","2:21.2.4-0ubuntu2.2","2:21.2.4-0ubuntu2.3","2:21.2.4-0ubuntu2.4","2:21.2.4-0ubuntu2.5","2:21.2.4-0ubuntu2.6","2:21.2.4-0ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.2.1-0ubuntu2.6"}]}],"versions":["3:24.0.0-0ubuntu1","3:24.0.0+git2022030310.3f274c65cc-0ubuntu2","3:25.0.0-0ubuntu1","3:25.0.0-0ubuntu1.1","3:25.0.1-0ubuntu1","3:25.1.0-0ubuntu1","3:25.1.0-0ubuntu2","3:25.1.0-0ubuntu2.1","3:25.1.0-0ubuntu2.2","3:25.1.1-0ubuntu1","3:25.1.1-0ubuntu1.1","3:25.2.0-0ubuntu1","3:25.2.1-0ubuntu1","3:25.2.1-0ubuntu2","3:25.2.1-0ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:29.0.1-0ubuntu1.4"}]}],"versions":["3:28.0.0-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu1","3:28.0.1+git2024011916.087c372a-0ubuntu2","3:29.0.0~rc1-0ubuntu2","3:29.0.1-0ubuntu1","3:29.0.1-0ubuntu1.3"]}],"products":[{"vendor":"openstack","product":"nova"}],"references":[{"url":"https://launchpad.net/bugs/2071734","tags":["x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://security.openstack.org","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/07/23/2","tags":["x_transferred","Mailing List","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2024-002.html","tags":["x_transferred","Vendor Advisory","web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40767","tags":["advisory"]},{"url":"https://review.opendev.org/c/openstack/nova/+/924731","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rm86-h44c-2r2m","tags":["advisory"]},{"url":"https://github.com/openstack/nova","tags":["package"]},{"url":"https://pypi.org/project/nova","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5083","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2297217","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5083.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-40767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-40767","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5097","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5097.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5113","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5113.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-40767","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6911-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-40767","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-24T00:00:00Z","modified":"2025-11-04T16:12:31.887Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-2412","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-24T00:00:00Z","modified":"2025-11-04T16:12:31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-rm86-h44c-2r2m","title":"OpenStack Nova vulnerable to unauthorized access to potentially sensitive data ","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-24T06:31:10Z","modified":"2025-11-04T19:49:52Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-436","CWE-552"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-40767","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-24T05:15:12.907Z","modified":"2026-06-17T07:46:30.29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"GHSA-rm86-h44c-2r2m","title":"OpenStack Nova vulnerable to unauthorized access to potentially sensitive data ","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-24T06:31:10Z","modified":"2026-07-07T17:56:30.078278926Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-436","CWE-552"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"PYSEC-2026-1709","title":"OpenStack Nova vulnerable to unauthorized access to potentially sensitive data ","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2026-07-07T14:34:37.675804Z","modified":"2026-07-07T17:46:29.836759281Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2024:5083","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.3 security update","status":"published","published":"2024-09-27T16:38:48Z","modified":"2026-08-08T10:05:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5097","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.6 security update","status":"published","published":"2024-09-27T16:45:10Z","modified":"2026-08-08T10:05:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5113","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-nova) security update","status":"published","published":"2024-09-27T16:45:26Z","modified":"2026-08-08T10:05:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-40767","description":"In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.","status":"published","published":"2024-07-23T15:00:00Z","modified":"2026-02-04T03:17:48.591705Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"USN-6911-1","title":"nova vulnerability","description":"Arnaud Morin discovered that Nova incorrectly handled certain raw format\nimages. An authenticated user could use this issue to access arbitrary\nfiles on the server, possibly exposing sensitive information.\n","status":"published","published":"2024-07-23T16:41:30Z","modified":"2026-04-27T17:22:07.560282Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}