CVE-2016-2140

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-2140
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2140.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-2140
Aliases
Downstream
Related
Published
2016-04-12T14:59:10Z
Modified
2026-07-08T12:53:49Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

References

Affected packages

Git / github.com/openstack/nova

Affected ranges

Type
GIT
Repo
https://github.com/openstack/nova
Events
Introduced
6df6ad3ff32f2b1fe2978df1032002548ad8eb66
Fixed
6fdf1c87b1149e8b395eaa9f4cbf27263cf96ac6
Introduced
8397b6464af520903f546ce4c6d51a2eb5b4c8a8
Fixed
cd81512f87476b0bad29db379d3b92b22723cd2e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.0.3"
        },
        {
            "introduced": "2015.1.0"
        },
        {
            "fixed": "2015.1.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

12.*
12.0.0
12.0.0.0rc3
12.0.1
12.0.2
2015.*
2015.1.0
2015.1.0rc3
2015.1.1
2015.1.2
2015.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2140.json"