CVE-2015-5306: High severity openstack ironic inspector vulnerability
It was discovered that enabling debug mode in ironic-discoverd would also enable debug mode in flask, which would in turn enable the flask console on error. An attacker able to trigger an error and expose the flask console could use the console to run arbitary python code.
Other sources
OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5306?
CVE-2015-5306 is considered a medium severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2015-5306?
To mitigate CVE-2015-5306, upgrade Ironic Inspector to version 2.2.2 or later.
What software is affected by CVE-2015-5306?
CVE-2015-5306 affects OpenStack Ironic Inspector and the python-ironic-inspector-client versions below 0.2.5.
What is the impact of CVE-2015-5306?
The impact of CVE-2015-5306 allows an attacker to execute arbitrary Python code if they can trigger an error while debug mode is enabled.
What causes CVE-2015-5306?
CVE-2015-5306 is caused by enabling debug mode in ironic-discoverd, which inadvertently exposes the Flask console.