Threats tagged 'ghsa-vhgc-6rjx-f6vv'

A vulnerability in Apache CloudStack allows account users by default to register templates that are downloaded directly to primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, attackers can register malicious templates that execute arbitrary code on KVM hosts. This can compromise resource integrity, confidentiality, cause data loss, denial of service, and affect availability of the KVM-based infrastructure. The issue is fixed in Apache CloudStack versions 4.20.3.0 and 4.22.0.1 or later.