GitHub Advisoryadvisory · PyPI

GHSA-f7cr-7c2c-fm8r OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

HIGH Published 2022-05-13 Modified 2024-05-14 Official page ↗
Aliases
CVE-2016-4985
Ecosystem
PyPI
Packages
ironic
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-05-14

Affected packages

• PyPI ironic: < 4.2.5 → fixed in 4.2.5 • PyPI ironic: >= 5.0, < 5.1.2 → fixed in 5.1.2

Description

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the `v1/drivers/$DRIVER_NAME/vendor_passthru` resource.

Related

Alias · CVE (1)

  • CVE-2016-4985 The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References