This bug was fixed in the package nova - 3:27.1.0-0ubuntu1.2~cloud0 ---------------
nova (3:27.1.0-0ubuntu1.2~cloud0) jammy; urgency=medium . * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data (LP: #2059809) - debian/patches/CVE-2024-32498-1.patch: reject qcow files with data-file attributes. - debian/patches/CVE-2024-32498-2.patch: check images with format_inspector for safety. - debian/patches/CVE-2024-32498-3.patch: additional qemu safety checking on base images. - debian/patches/CVE-2024-32498-4.patch: fix vmdk_allowed_types checking. - CVE-2024-32498
This bug was fixed in the package nova - 3:27.1. 0-0ubuntu1. 2~cloud0
---------------
nova (3:27.1. 0-0ubuntu1. 2~cloud0) jammy; urgency=medium patches/ CVE-2024- 32498-1. patch: reject qcow files with patches/ CVE-2024- 32498-2. patch: check images with
format_ inspector for safety. patches/ CVE-2024- 32498-3. patch: additional qemu safety patches/ CVE-2024- 32498-4. patch: fix vmdk_allowed_types
.
* SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
(LP: #2059809)
- debian/
data-file attributes.
- debian/
- debian/
checking on base images.
- debian/
checking.
- CVE-2024-32498