Julia Kreger

The issue allows a malicious project assigned as a node owner to provide a path to any local file readable by `ironic-conductor`, which may then be written to the target node disk during image handling via the API. This is particularly dangerous in environments with non-default, insecure configurations, such as those with automated cleaning disabled.

The issue is related to a lack of checksum validation of supplied image source URLs when configured to convert images to a raw format for streaming. This affects the ability to ensure the integrity of the images being used.

The issue concerns a vulnerability in image processing, where a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, potentially leading to unauthorized access to sensitive data.