REDHAT-BUG-2297217: High severity Ovh Nova vulnerability
Arnaud Morin (OVH) reported a vulnerability in Nova. By supplying a raw format image which is actually a specially crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file’s contents from the server resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2297217?
The severity of REDHAT-BUG-2297217 is critical due to the potential exposure of sensitive data through unauthorized file access.
How do I fix REDHAT-BUG-2297217?
To fix REDHAT-BUG-2297217, update your OVH Nova software to the latest patched version as provided in the official security advisories.
Who is affected by REDHAT-BUG-2297217?
Authenticated users of OVH Nova who can supply crafted QCOW2 or VMDK images are affected by REDHAT-BUG-2297217.
What type of attacks is REDHAT-BUG-2297217 associated with?
REDHAT-BUG-2297217 is associated with data exposure attacks that exploit specially crafted image files.
What products are impacted by REDHAT-BUG-2297217?
The impacted product for REDHAT-BUG-2297217 is OVH Nova, specifically versions up to the latest release.