-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of VMDK subformats (e.g., 'monolithicFlat') and backing file paths during image processing. The patches for Cinder, Glance, and Nova explicitly add checks in these functions to restrict allowed VMDK types (e.g., 'streamOptimized', 'monolithicSparse') and validate file paths. These functions were directly responsible for converting/processing images without the necessary security checks, as evidenced by the commit discussions and CVE analysis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cinder | pip | < 19.1.2 | 19.1.2 |
| cinder | pip | >= 20.0.0, < 20.0.2 | 20.0.2 |
| glance | pip | < 23.0.1 | 23.0.1 |
| glance | pip | >= 24.0.0, < 24.1.1 | 24.1.1 |
| nova | pip | < 24.1.2 | 24.1.2 |
| nova | pip | >= 25.0.0, < 25.0.2 | 25.0.2 |