| Package | Affected versions | Patched versions |
|---|---|---|
| cinder | ≥ 8.0.0, < 9.0.0< 7.0.2 | 9.0.07.0.2 |
| glance | < 14.0.0 | 14.0.0 |
| nova | < 12.0.4 | 12.0.4 |
| cinder | = 7.0.2= 8.0.0= 8.1.0 | |
| glance | = 11.0.1= 12.0.0≤ 11.0.0 | |
| nova | = 13.0.0≤ 12.0.3 |
The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free