CVE catalog

CVE-2024-40767

Nova vulnerability

[CVE catalog]

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.95% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitynova2:31.0.0-6+deb13u2Not affected[CVE-2024-40767]
DebiantrixienovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debiantrixienova2:31.0.0-6+deb13u2Not affected[CVE-2024-40767]
DebiansidnovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debiansidnova2:34.0.0-4Not affected[CVE-2024-40767]
Ubuntupronova2:16.0.1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:16.0.1-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b2-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b3-0ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b3-0ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]

Showing 12 observations. All 115 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportednova3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-ajax-console-proxy3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-api3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-api-metadata3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-api-os-compute3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-api-os-volume3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-cells3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-common3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-ironic3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-kvm3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-libvirt3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-lxc3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-qemu3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-vmware3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-compute-xen3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-conductor3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-doc3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-novncproxy3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-scheduler3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-serialproxy3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-spiceproxy3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportednova-volume3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedpython3-nova3:29.0.1-0ubuntu1.4UnknownSource applicability is not establishedProvider not reported
DebianbookwormnovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debianbookwormnova2:26.2.2-1~deb12u4Not affected[CVE-2024-40767]
Debianbookworm-securitynova2:26.2.2-1~deb12u4Not affected[CVE-2024-40767]
DebianforkynovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debianforkynova2:33.0.2-1Not affected[CVE-2024-40767]
DebiansidnovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debiansidnova2:34.0.0-4Not affected[CVE-2024-40767]
DebiantrixienovaNot reportedNot affectedDistribution reports not affected[CVE-2024-40767]
Debiantrixienova2:31.0.0-6+deb13u2Not affected[CVE-2024-40767]
Debiantrixie-securitynova2:31.0.0-6+deb13u2Not affected[CVE-2024-40767]
Ubuntu20.04nova2:20.0.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0-0ubuntu0.20.04.1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0-0ubuntu0.20.04.2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.1.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.1.1-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.1.2-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.1-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.2-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.3-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.11UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.3UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.4UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.5UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.6UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu20.04nova2:21.2.4-0ubuntu2.8UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:24.0.0+git2022030310.3f274c65cc-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:24.0.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.0.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.0.0-0ubuntu1.1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.0.1-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.0-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.0-0ubuntu2.1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.0-0ubuntu2.2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.1-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.1.1-0ubuntu1.1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.2.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.2.1-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.2.1-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.2.1-0ubuntu2.3UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu22.04nova3:25.2.1-0ubuntu2.6UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:28.0.0-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:28.0.1+git2024011916.087c372a-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:28.0.1+git2024011916.087c372a-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:29.0.0~rc1-0ubuntu2UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:29.0.1-0ubuntu1UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:29.0.1-0ubuntu1.3UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntu24.04nova3:29.0.1-0ubuntu1.4UnknownSource applicability is not established[USN-6911-1][UBUNTU-CVE-2024-40767]
Ubuntupronova2:16.0.1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:16.0.1-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b2-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b3-0ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~b3-0ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~rc1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~rc2-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.0~rc3-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.1-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.10-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.10-0ubuntu2.1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.11-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.12-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu5.2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu5.3UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu5.4UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.13-0ubuntu5.4+esm1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.3-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.4-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.5-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.5-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.6-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.7-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.7-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.9-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Ubuntupronova2:17.0.9-0ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2024-40767]
Original provider fields
{
  "package_releases": [
    {
      "name": "nova",
      "status": "not affected",
      "release": "sid",
      "version": "2:34.0.0-4"
    },
    {
      "name": "nova",
      "status": "not affected",
      "release": "forky",
      "version": "2:33.0.2-1"
    },
    {
      "name": "nova",
      "status": "not affected",
      "release": "trixie",
      "version": "2:31.0.0-6+deb13u2"
    },
    {
      "name": "nova",
      "status": "not affected",
      "release": "trixie-security",
      "version": "2:31.0.0-6+deb13u2"
    },
    {
      "name": "nova",
      "status": "not affected",
      "release": "bookworm",
      "version": "2:26.2.2-1~deb12u4"
    },
    {
      "name": "nova",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "2:26.2.2-1~deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "nova",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "nova",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "nova",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "nova",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "nova",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-ajax-console-proxy",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-api",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-api-metadata",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-api-os-compute",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-api-os-volume",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-cells",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-common",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-ironic",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-kvm",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-libvirt",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-lxc",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-qemu",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-vmware",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-compute-xen",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-conductor",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-doc",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-novncproxy",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-scheduler",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-serialproxy",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-spiceproxy",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova-volume",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "python3-nova",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:21.2.4-0ubuntu2.11"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2:20.0.0-0ubuntu1",
        "2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5",
        "2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2",
        "2:21.0.0-0ubuntu0.20.04.1",
        "2:21.0.0-0ubuntu0.20.04.2",
        "2:21.1.0-0ubuntu1",
        "2:21.1.1-0ubuntu2",
        "2:21.1.2-0ubuntu1",
        "2:21.2.0-0ubuntu1",
        "2:21.2.1-0ubuntu1",
        "2:21.2.2-0ubuntu1",
        "2:21.2.3-0ubuntu1",
        "2:21.2.4-0ubuntu1",
        "2:21.2.4-0ubuntu2",
        "2:21.2.4-0ubuntu2.1",
        "2:21.2.4-0ubuntu2.2",
        "2:21.2.4-0ubuntu2.3",
        "2:21.2.4-0ubuntu2.4",
        "2:21.2.4-0ubuntu2.5",
        "2:21.2.4-0ubuntu2.6",
        "2:21.2.4-0ubuntu2.8"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6911-1",
      "fixed_version": "2:21.2.4-0ubuntu2.11",
      "provider_source": "pypi",
      "provider_record_id": "USN-6911-1",
      "provider_updated_at": "2026-04-27T17:22:07.560282Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:25.2.1-0ubuntu2.6"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3:24.0.0-0ubuntu1",
        "3:24.0.0+git2022030310.3f274c65cc-0ubuntu2",
        "3:25.0.0-0ubuntu1",
        "3:25.0.0-0ubuntu1.1",
        "3:25.0.1-0ubuntu1",
        "3:25.1.0-0ubuntu1",
        "3:25.1.0-0ubuntu2",
        "3:25.1.0-0ubuntu2.1",
        "3:25.1.0-0ubuntu2.2",
        "3:25.1.1-0ubuntu1",
        "3:25.1.1-0ubuntu1.1",
        "3:25.2.0-0ubuntu1",
        "3:25.2.1-0ubuntu1",
        "3:25.2.1-0ubuntu2",
        "3:25.2.1-0ubuntu2.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6911-1",
      "fixed_version": "3:25.2.1-0ubuntu2.6",
      "provider_source": "pypi",
      "provider_record_id": "USN-6911-1",
      "provider_updated_at": "2026-04-27T17:22:07.560282Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:29.0.1-0ubuntu1.4"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3:28.0.0-0ubuntu1",
        "3:28.0.1+git2024011916.087c372a-0ubuntu1",
        "3:28.0.1+git2024011916.087c372a-0ubuntu2",
        "3:29.0.0~rc1-0ubuntu2",
        "3:29.0.1-0ubuntu1",
        "3:29.0.1-0ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6911-1",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "provider_source": "pypi",
      "provider_record_id": "USN-6911-1",
      "provider_updated_at": "2026-04-27T17:22:07.560282Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2:16.0.1-0ubuntu1",
        "2:16.0.1-0ubuntu2",
        "2:17.0.0~b1-0ubuntu1",
        "2:17.0.0~b2-0ubuntu2",
        "2:17.0.0~b3-0ubuntu3",
        "2:17.0.0~b3-0ubuntu4",
        "2:17.0.0~rc1-0ubuntu1",
        "2:17.0.0~rc2-0ubuntu1",
        "2:17.0.0~rc3-0ubuntu1",
        "2:17.0.0-0ubuntu1",
        "2:17.0.1-0ubuntu1",
        "2:17.0.3-0ubuntu1",
        "2:17.0.4-0ubuntu1",
        "2:17.0.5-0ubuntu1",
        "2:17.0.5-0ubuntu2",
        "2:17.0.6-0ubuntu1",
        "2:17.0.7-0ubuntu1",
        "2:17.0.7-0ubuntu2",
        "2:17.0.9-0ubuntu1",
        "2:17.0.9-0ubuntu3",
        "2:17.0.10-0ubuntu2",
        "2:17.0.10-0ubuntu2.1",
        "2:17.0.11-0ubuntu1",
        "2:17.0.12-0ubuntu1",
        "2:17.0.13-0ubuntu1",
        "2:17.0.13-0ubuntu2",
        "2:17.0.13-0ubuntu3",
        "2:17.0.13-0ubuntu4",
        "2:17.0.13-0ubuntu5",
        "2:17.0.13-0ubuntu5.2",
        "2:17.0.13-0ubuntu5.3",
        "2:17.0.13-0ubuntu5.4",
        "2:17.0.13-0ubuntu5.4+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-40767",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-40767",
      "provider_updated_at": "2026-02-04T03:17:48.591705Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:21.2.4-0ubuntu2.11"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2:20.0.0-0ubuntu1",
        "2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4",
        "2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5",
        "2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2",
        "2:21.0.0-0ubuntu0.20.04.1",
        "2:21.0.0-0ubuntu0.20.04.2",
        "2:21.1.0-0ubuntu1",
        "2:21.1.1-0ubuntu2",
        "2:21.1.2-0ubuntu1",
        "2:21.2.0-0ubuntu1",
        "2:21.2.1-0ubuntu1",
        "2:21.2.2-0ubuntu1",
        "2:21.2.3-0ubuntu1",
        "2:21.2.4-0ubuntu1",
        "2:21.2.4-0ubuntu2",
        "2:21.2.4-0ubuntu2.1",
        "2:21.2.4-0ubuntu2.2",
        "2:21.2.4-0ubuntu2.3",
        "2:21.2.4-0ubuntu2.4",
        "2:21.2.4-0ubuntu2.5",
        "2:21.2.4-0ubuntu2.6",
        "2:21.2.4-0ubuntu2.8"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-40767",
      "fixed_version": "2:21.2.4-0ubuntu2.11",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-40767",
      "provider_updated_at": "2026-02-04T03:17:48.591705Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:25.2.1-0ubuntu2.6"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3:24.0.0-0ubuntu1",
        "3:24.0.0+git2022030310.3f274c65cc-0ubuntu2",
        "3:25.0.0-0ubuntu1",
        "3:25.0.0-0ubuntu1.1",
        "3:25.0.1-0ubuntu1",
        "3:25.1.0-0ubuntu1",
        "3:25.1.0-0ubuntu2",
        "3:25.1.0-0ubuntu2.1",
        "3:25.1.0-0ubuntu2.2",
        "3:25.1.1-0ubuntu1",
        "3:25.1.1-0ubuntu1.1",
        "3:25.2.0-0ubuntu1",
        "3:25.2.1-0ubuntu1",
        "3:25.2.1-0ubuntu2",
        "3:25.2.1-0ubuntu2.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-40767",
      "fixed_version": "3:25.2.1-0ubuntu2.6",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-40767",
      "provider_updated_at": "2026-02-04T03:17:48.591705Z",
      "applicability_unknown": true
    },
    {
      "name": "nova",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3:29.0.1-0ubuntu1.4"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "3:28.0.0-0ubuntu1",
        "3:28.0.1+git2024011916.087c372a-0ubuntu1",
        "3:28.0.1+git2024011916.087c372a-0ubuntu2",
        "3:29.0.0~rc1-0ubuntu2",
        "3:29.0.1-0ubuntu1",
        "3:29.0.1-0ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-40767",
      "fixed_version": "3:29.0.1-0ubuntu1.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-40767",
      "provider_updated_at": "2026-02-04T03:17:48.591705Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [nova-api]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-common]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-compute]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-compute-ironic]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-compute-kvm]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-compute-lxc]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-compute-qemu]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-conductor]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-consoleproxy]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-doc]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [nova-scheduler]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

  • [python3-nova]Unknown

    Source package: [nova]

    Details (4)

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

    • 2:26.2.2-1~deb12u4 · all · bookworm-security

      Not affected

      usn · nova · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]