6.5

CVE-2024-40767: openstack nova

CVSS: 6.5v3.1MediumModified
AliasesGHSA-rm86-h44c-2r2mPYSEC-2026-1709RHSA-2024:5083
Published 24-07-2024Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2024-40767 is a medium (CVSS 6.5) vulnerability in openstack nova. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.95%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 24-07-2024
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.95%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

+0.01 pp

From 0.94% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.95%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat12 products
  • openstack-nova< 1:23.2.3-17.1.20231018130829.el9ost | < 1:20.6.2-2.20230814165229.el8ost | < 1:20.4.1-1.20221005193235.el8ost
  • openstack-nova-api< 1:23.2.3-17.1.20231018130829.el9ost | < 1:20.6.2-2.20230814165229.el8ost | < 1:20.4.1-1.20221005193235.el8ost
  • openstack-nova-common< 1:23.2.3-17.1.20231018130829.el9ost | < 1:20.6.2-2.20230814165229.el8ost | < 1:20.4.1-1.20221005193235.el8ost
  • openstack-nova-compute< 1:23.2.3-17.1.20231018130829.el9ost | < 1:20.6.2-2.20230814165229.el8ost | < 1:20.4.1-1.20221005193235.el8ost
  • openstack-nova-conductor< 1:23.2.3-17.1.20231018130829.el9ost | < 1:20.6.2-2.20230814165229.el8ost | < 1:20.4.1-1.20221005193235.el8ost
Openstack1 product
  • nova< 27.4.1 | ≥ 28.0.0, < 28.2.1 | ≥ 29.0.0, < 29.1.1
PyPI1 product
  • nova≤ 27.4.0 | ≥ 28.0.0, ≤ 28.2.0 | ≥ 29.0.0, ≤ 29.1.0
Ubuntu1 product
  • novaAll versions (No fix recorded) | < 2:21.2.4-0ubuntu2.11 | < 3:25.2.1-0ubuntu2.6 | < 3:29.0.1-0ubuntu1.4

4 vendors · 15 products

References

22 links
Show all 22 references