Threats tagged 'ghsa-mfg3-p6m3-gjgr'

OpenStack Nova versions 18.0.0 through 31.3.0, 32.0.0 through 32.2.0, and 33.0.0 through 33.0.1 contain a vulnerability where the server create API does not strip internal scheduler hints. This allows an authenticated user to bypass Placement resource claims and scheduling constraints such as availability zone, host aggregate, and image trait restrictions. The affected instance lacks Placement allocation, potentially causing compute node resource exhaustion and cross-tenant data persistence on NVMe devices after instance deletion. Fixes are available in versions 32.2.1 and 33.0.2.