It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image,...

References

• advisory http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html
• advisory https://access.redhat.com/errata/RHEA-2018:2624
• patch https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10908
• patch https://gerrit.ovirt.org/#/c/93195/