-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization in the file injection mechanism. The original implementation of _inject_file_into_fs in api.py used os.path.join(fs, path.lstrip('/')) without resolving symlinks or checking for traversal. The fix introduced _join_and_check_path_within_fs to normalize paths and ensure they stay within the guest filesystem. The commit message explicitly states this addresses CVE-2012-3360, and the diff shows _inject_file_into_fs was modified to use the new safety check. Unit tests added in test_virt.py verify that paths with '..' are rejected, confirming the vulnerable function's behavior before patching.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 12.0.0a0 | 12.0.0a0 |