OpenStack-announce

Download

openstack-announce@lists.openstack.org

February 2026

2 participants
2 discussions

[all][elections][tc] 2026.2 Hibiscus Technical Committee Election Results
by Ian Y. Choi 26 Feb '26

26 Feb '26

Please join me in congratulating the 5 newly elected members of the Technical Committe (TC). - Amy Marrich (spotz) - Dan Smith (dansmith) - Goutham Pacha Ravi (gouthamr) - Michal Nasiadka (mnasiadka) - Dmitriy Rabotyagov (noonedeadpunk) Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round.

1 0

[OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708)
by Jeremy Stanley 18 Feb '26

18 Feb '26

========================================================================= OSSA-2026-002: Nova calls qemu-img without format restrictions for resize ========================================================================= :Date: January 17, 2026 :CVE: CVE-2026-24709 Affects ~~~~~~~ - Nova: <30.2.2, >=31.0.0 <31.2.1, >=32.0.0 <32.1.1 Description ~~~~~~~~~~~ Dan Smith from Red Hat reported a vulnerability in nova. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's flat image backend to call qemu-img without a format restriction resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected. Patches ~~~~~~~ - https://review.opendev.org/977104 (2024.2/dalmatian) - https://review.opendev.org/977103 (2025.1/epoxy) - https://review.opendev.org/977101 (2025.2/flamingo) - https://review.opendev.org/977100 (2026.1/gazpacho) Credits ~~~~~~~ - Dan Smith from Red Hat (CVE-2026-24708) References ~~~~~~~~~~ - https://launchpad.net/bugs/2137507 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24709 -- Jeremy Stanley OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1