| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| nova | ≥ 18.0.0, ≤ 31.3.0≥ 18.0.0, < 31.3.1≥ 32.0.0, < 32.2.1≥ 33.0.0, < 33.0.2 | 31.3.132.2.133.0.2 |
| nova | ≥ 18.0.0, < 31.3.1≥ 32.0.0, < 32.2.1≥ 33.0.0, < 33.0.2 | 31.3.132.2.133.0.2 |
Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling constraint enforcement, including availability zone, host aggregate, and image trait restrictions. The resulting instance has no Placement allocation, which can lead to compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Deployments running Nova 18.0.0 or later are affected.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí