CVE-2016-2140
published 2016-04-12CVE-2016-2140: The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to…
medium5.3CVSS 3.0
AVNACHPRLUINSUCHINAN
The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nova | < nova 2:13.0.0-1 (bookworm) | nova 2:13.0.0-1 (bookworm) |
| openstack | nova | >= 0 < 2:13.0.0-1 | 2:13.0.0-1 |
| openstack | nova | >= 0 < 2:13.0.0-1 | 2:13.0.0-1 |
| openstack | nova | >= 0 < 2:13.0.0-1 | 2:13.0.0-1 |
| openstack | nova | >= 0 < 2:13.0.0-1 | 2:13.0.0-1 |
| openstack | nova | >= 0 < 1:2014.1.5-0ubuntu1.7 | 1:2014.1.5-0ubuntu1.7 |
| openstack | nova | >= 12.0.0 < 12.0.3 | 12.0.3 |
| openstack | nova | >= 12.0.0 < 12.0.3 | 12.0.3 |
| openstack | nova | >= 2015.1.0 < 2015.1.4 | 2015.1.4 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
osv6.8MEDIUM