I just discussed with Dan. As he just explained, even if the default format inspector won't check that it's another format but RAW, nova will know treat it as RAW and fail accordingly so we should be fine.
I also agreed on the Glance proposal he explained above (detecting the format in the upload pipeline) but for the sake of this CVE, this would only be an improvement and not be part of the CVE resolution.
I just discussed with Dan. As he just explained, even if the default format inspector won't check that it's another format but RAW, nova will know treat it as RAW and fail accordingly so we should be fine.
I also agreed on the Glance proposal he explained above (detecting the format in the upload pipeline) but for the sake of this CVE, this would only be an improvement and not be part of the CVE resolution.