GitHub Advisoryadvisory · PyPI

GHSA-8h22-6qwx-q4w9 OpenStack Ironic fails to verify checksums of supplied image_source URLs

MEDIUM Published 2024-10-04 Modified 2024-11-05 Official page ↗
Aliases
CVE-2024-47211
Ecosystem
PyPI
Packages
ironic
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-354
Reviewed
2024-10-04

Affected packages

• PyPI ironic: >= 25.0.0, < 26.1.1 → fixed in 26.1.1 • PyPI ironic: >= 23.1.0, < 24.1.3 → fixed in 24.1.3 • PyPI ironic: >= 22.0.0, < 23.0.3 → fixed in 23.0.3 • PyPI ironic: <= 21.4.3 (no fix yet)

Description

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Related

Alias · CVE (1)

  • CVE-2024-47211 In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a… vulnerability

Weakness · CWE (1)

  • CWE-354 Improper Validation of Integrity Check Value weakness

References