DSA-5337: -1 nova -- security update

Published Feb 1, 2023

Updated

Guillaume Espanel, Pierre Libeau, Arnaud Morin and Damien Rannou discovered that missing input sanitising in the handling of VMDK images in OpenStack Compute (codenamed Nova) may result in information disclosure.

Affected Software

2 affected components

debian/nova

Event History

Feb 1, 2023

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-47951

Frequently Asked Questions

Which deployments are within the stated exposure?

The issue is associated with OpenStack Compute deployments that handle VMDK images. The provided advisory does not identify other image formats or deployment scenarios as affected.

Does the advisory say whether a default configuration is affected?

No. The provided information does not state whether VMDK image handling is enabled or reachable in a default Nova configuration.