Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.
Recommended action: Upgrade to 37.0.1, 35.0.2, 32.0.2 or 29.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenStack Ironic 32.0.0 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
Recommended action: Upgrade to 37.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
Recommended action: Upgrade to 35.0.2, 32.0.2, 29.0.6 or 26.1.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenStack Ironic through 35.0.x allows Boot Script Injection.
Recommended action: Upgrade to 35.0.2, 32.0.2, 29.0.6 or 26.1.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
Recommended action: Upgrade to 35.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.
Recommended action: Upgrade to 29.0.1, 26.1.1 or 24.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied imagesource URLs when configured to convert images to a raw format for streaming.
Recommended action: Upgrade to 26.1.1, 24.1.3 or 23.0.3 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVERNAME/vendorpassthru resource.
Recommended action: Upgrade to 5.1.2 or 4.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.