> I did it by creating images with vmdk and it worked in the past. I also convert vmdk to qcow2 but my instances stucked at boot. It is weird.

Right, part of the problem that the CVE fixes addressed was our willingness to accept any image *content* regardless of what the metadata on the image was. That led to the security issue and that is what is fixed (i.e. no longer allowed).

If you're using libvirt hypervisors, you need to use an image format that is supported by that driver. The most similar format would be qcow2. You can technically use qemu-img to convert between the two, but virt-v2v[1] should do a better job.

--Dan

[1] https://libguestfs.org/virt-v2v.1.html