This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache CloudStack fixes a high-severity vulnerability
Apache versions 4.18.2.5 and 4.19.1.3 fix a high-severity vulnerability [1].
Allows an authenticated remote attacker, due to insufficient checks when registering KVM-compatible templates, to deploy a malicious template to a virtual machine. The attacker can thereby gain unauthorized access to data or carry out a DoS attack on the host system [2]. In addition to updating to a fixed version, it is recommended to check whether KVM-compatible templates registered by users contain unauthorized or redundant features. For example, the operator can use the command-line tool "qemu-img" to identify suspicious disks with references to host file systems, but the results may include both false positives and false negatives. For more information, see [1].
The vulnerability is present in product:
- Apache CloudStack; >=4, <4.18.2.5; >=4.19, <4.19.1.3;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-50386 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Links
By CESNET, z.s.p.o. Michaela Ručková on 25. 11. 2024.