Ubuntu alert USN-8049-1 (nova)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8049-1] Nova vulnerability
Date:
             
 
Tue, 17 Feb 2026 19:48:14 +0000
Message-ID:
             
 
<E1vsR3O-00043q-Am@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8049-1
February 17, 2026

nova vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Nova could be made to destroy data.

Software Description:
- nova: OpenStack Compute cloud infrastructure

Details:

Dan Smith discovered that Nova incorrectly called qemu-img without a format
restriction when resizing disks. An attacker could possibly use this issue
to destroy data on the host system.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  nova-common                     3:32.0.0-0ubuntu1.1
  python3-nova                    3:32.0.0-0ubuntu1.1

Ubuntu 24.04 LTS
  nova-common                     3:29.2.0-0ubuntu1.3
  python3-nova                    3:29.2.0-0ubuntu1.3

Ubuntu 22.04 LTS
  nova-common                     3:25.2.1-0ubuntu2.10
  python3-nova                    3:25.2.1-0ubuntu2.10

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8049-1
  CVE-2026-24708

Package Information:
  https://launchpad.net/ubuntu/+source/nova/3:32.0.0-0ubunt...
  https://launchpad.net/ubuntu/+source/nova/3:29.2.0-0ubunt...
  https://launchpad.net/ubuntu/+source/nova/3:25.2.1-0ubunt...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmmUxcwACgkQcpJm3tlz
hgH/BBAAxenEWAs65wP8ZAXZzObnsLUEE2FdQTNz5BF46uSOe6kYAw1+2dowOeO+
5/W2usJpvwC/nGIQgOcei8jehYmmXqukVNrdyPohCM9KetOmuJuk3d2Q7qFAlUXy
x72TYNDhQd1P5hyAR19rQg84/KAQbMzk6KdONAfw//fCfI9RApSfRVGXvgBzfHEP
hr0nb0GXRlU5lpTXya97SDKHIWcl68fUSoevm0xb/F0JTlRkNZ55iQq6ke5FRzMW
55RFYGJBQP3huESVlqywY8+eoHCO+9hCT+wQsdv8Hd7Su1kvM4hMyeJKLnEPv2DL
TMtHYNE6NM/Z5Qq+c3udHREcFdfuMY+gfy5qbxYKbS+9Ox2CtRBu4FWM8bMog59b
ZYgxGtQNcWU5W7cfQNotnNqlyeQxjX0zl3RaY1tXTgnugvWo7cwjMhZlDOwOdoxj
uPA12iTiQs4uvd4Zy7hwE7KDn3vPOISAbKUcn46bfSxvkVAiI46rdfnOppMyA6S4
LnqhOCG2om83xp+09BPXVMjzVISnEOfbSVm0JbgBWcQ/OS+f9NvdnFTDpCiwAiM1
m71ZxR4u5xVhbp3y639n8rZBKHMm35ZApknaALR+LYZQmGkPRldItXN92m3ch70J
nASY16P89RzgKfUgZSpbLnkbO00sQO5e6hRM83oT9rG8h6HI0/I=
=M4zK
-----END PGP SIGNATURE-----