Openstack nova qcow format could expose host filesystem information

HIGH 8.6CVE-2011-3147 · GHSA-hqfx-4x4w-vmwp · PYSEC-2026-690 · Published 22/04/2019 · updated 16/06/2026

Package	Affected versions	Patched versions
nova PyPI	`< 12.0.0a0`	`12.0.0a0`
nova openstack	`≥ 2010.1, < 2012.1`	`2012.1`

Description

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.

NVD description

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.

References

nvd.nist.gov/vuln/detail/CVE-2011-3147 · ADVISORY
openstack/nova commit ff9d353 · WEB
bugs.launchpad.net/nova/+bug/853330 · WEB
bazaar.launchpad.net/~hudson-openstack/nova/trunk/revision/1604 · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-hqfx-4x4w-vmwp · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free