CVE-2015-7514: Infoleak
A flaw was reported in Ironic:
Brad Morgan from Rackspace reported a vulnerability in Ironic. To prevent user data leak, Ironic is expected to "clean" a server after use, however that is transparently not happening. Previous tenant's data may be left behind on the disk and may be available to new users. All Ironic setups are affected.
This flaw is reported to affect versions >= 4.2.0 and <= 4.2.1.
Acknowledgements:
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brad Morgan from Rackspace as the original reporter.
Other sources
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7514?
CVE-2015-7514 is considered a medium severity vulnerability as it can lead to data leakage between tenants.
How do I fix CVE-2015-7514?
To fix CVE-2015-7514, upgrade OpenStack Ironic to version 4.2.2 or later to ensure proper data cleaning between user sessions.
What does CVE-2015-7514 affect?
CVE-2015-7514 affects OpenStack Ironic versions 4.2.0 and 4.2.1.
What is the impact of CVE-2015-7514?
The impact of CVE-2015-7514 is that residual data from previous tenants may remain on the disk, potentially exposing sensitive information.
Who reported CVE-2015-7514?
CVE-2015-7514 was reported by Brad Morgan from Rackspace.