A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1.

Summary

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

Timeline

1. Jul 30, 2019, 4:22 PM UTCCVE published
2. Aug 4, 2024, 10:10 PM UTCRecord last updated

Affected versions

• RedHat openstack-ironic-inspector

  8.2.0

• ironic-inspectorPyPI

  From 6.1.0 · fixed in 7.2.4; From 8.1.0 · fixed in 8.2.1; fixed in 5.0.2; From 5.1.0 · fixed in 6.0.3; From 8.0.0 · fixed in 8.0.3

• ironic-inspectorPyPI

  fixed in 5.0.2

• ironic-inspectorPyPI

  From 5.1.0 · fixed in 6.0.3

• ironic-inspectorPyPI

  From 6.1.0 · fixed in 7.2.4

• ironic-inspectorPyPI

  From 8.0.0 · fixed in 8.0.3

• ironic-inspectorPyPI

  From 8.1.0 · fixed in 8.2.1

References 7