PT-2019-6662 · Openstack · Nova

Published 2019-04-22 · Updated 2022-04-22 · CVE-2011-3147

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nova versions prior to 2012.1

Description The issue allows hypervisor host files to be exposed to a guest operating system when a maliciously constructed qcow filesystem is processed.

Recommendations For versions prior to 2012.1, update to version 2012.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-3147

GHSA-HQFX-4X4W-VMWP

Affected Products

Nova

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2011-3147 · Security Note
• http://bazaar.launchpad.net/~hudson-openstack/nova/trunk/revision/1604 · Patch
• https://osv.dev/vulnerability/GHSA-hqfx-4x4w-vmwp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3147 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3147 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3147 · Vendor Advisory
• https://github.com/openstack/nova/commit/ff9d353b2f4fee469e530fbc8dc231a41f6fed84 · Note
• https://bugs.launchpad.net/nova/+bug/853330 · Note