==========================================================================
Ubuntu Security Notice USN-6911-1
July 23, 2024

nova vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Summary:

Nova would allow unintended access to files over the network.

Software Description:

• nova: OpenStack Compute cloud infrastructure

Details:

Arnaud Morin discovered that Nova incorrectly handled certain raw format
images. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
nova-common 3:29.0.1-0ubuntu1.4
python3-nova 3:29.0.1-0ubuntu1.4

Ubuntu 22.04 LTS
nova-common 3:25.2.1-0ubuntu2.6
python3-nova 3:25.2.1-0ubuntu2.6

Ubuntu 20.04 LTS
nova-common 2:21.2.4-0ubuntu2.11
python3-nova 2:21.2.4-0ubuntu2.11

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6911-1
CVE-2024-40767

Package Information:
https://launchpad.net/ubuntu/+source/nova/3:29.0.1-0ubuntu1.4
https://launchpad.net/ubuntu/+source/nova/3:25.2.1-0ubuntu2.6
https://launchpad.net/ubuntu/+source/nova/2:21.2.4-0ubuntu2.11