[USN-6911-1] Nova vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmagATsACgkQZWnYVadE
vpP2wRAAoOtE2SGsH9oQQrp8CSMRJu31F3ggjkZa+tEVt7pG0MVLqIT8s/TbYB9t
5OGFIIUlgKCqLcDfynWuvoIPadFgm5umWsokByzst3Ex1KJmhXH7LXEr4QzlDc5R
VY6TXjbHpr1a2SSQrsN54lXf0BhCVUgE8XoDh4kBvc+yqc8CjoC65qgJfe/hipFh
LsHtghowu446aHbGaXrOVVCEbs7XJxVmY4eZzkGGxd1b2DvBe7YJmAQyqaoAcI8v
zrOy+GtD3L1qFc9BloXflYyfj//1ROm6QfpvZ0k9SabjPzbnSFGmFIkfvjFbFoZt
gAwqt91C9oAbTY2kcXyk9FzqhPJBS+XZuvzYxid9G1gfpTaWNnuHicf7zQveZMxy
4LcWVS/k/w4xG3M9z8Z+VwMlCgl2NONJbLOMlNbbVwG9NvNAsMMbQludtmtbxaMh
Qehn8z0Vu+zCLxL7lvDsni5why0CGax1Mgwzry7E2h2U7w6Hw8FsQaZGtLMxqcN3
bCyZlUpHAFyWVIgDehOMsytKcOM9LXnCVtZeNtTz5jpkWuvgOin6gamYoVN46bpL
3q+5TRVNmOZuX62szcZdaW6/6WEvouOBxACH16BFf7XP+F8TcGheBeZhfl6z5t+/
pytOfsNu1RnVk1MBoxDKeIPyRNfTJaHEu5LM4PQHEBvPW0LuRMw=
=xJ2z
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6911-1
July 23, 2024

nova vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Nova would allow unintended access to files over the network.

Software Description:
- nova: OpenStack Compute cloud infrastructure

Details:

Arnaud Morin discovered that Nova incorrectly handled certain raw format
images. An authenticated user could use this issue to access arbitrary
files on the server, possibly exposing sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
nova-common 3:29.0.1-0ubuntu1.4
python3-nova 3:29.0.1-0ubuntu1.4

Ubuntu 22.04 LTS
nova-common 3:25.2.1-0ubuntu2.6
python3-nova 3:25.2.1-0ubuntu2.6

Ubuntu 20.04 LTS
nova-common 2:21.2.4-0ubuntu2.11
python3-nova 2:21.2.4-0ubuntu2.11

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6911-1
CVE-2024-40767

Package Information:
https://launchpad.net/ubuntu/+source/nova/3:29.0.1-0ubuntu1.4
https://launchpad.net/ubuntu/+source/nova/3:25.2.1-0ubuntu2.6
https://launchpad.net/ubuntu/+source/nova/2:21.2.4-0ubuntu2.11