CVE-2015-7514: Infoleak
First published: Thu Nov 26 2015(Updated: )
A flaw was reported in Ironic: Brad Morgan from Rackspace reported a vulnerability in Ironic. To prevent user data leak, Ironic is expected to "clean" a server after use, however that is transparently not happening. Previous tenant's data may be left behind on the disk and may be available to new users. All Ironic setups are affected. This flaw is reported to affect versions >= 4.2.0 and <= 4.2.1. Acknowledgements: Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brad Morgan from Rackspace as the original reporter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Ironic | =4.2.0 | |
| OpenStack Ironic | =4.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099283
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099283&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099284
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099284&action=edit
- http://seclists.org/oss-sec/2015/q4/426
- https://bugzilla.redhat.com/show_bug.cgi?id=1285809
- http://www.openwall.com/lists/oss-security/2015/12/03/4
- https://review.openstack.org/#/c/252993
- https://review.openstack.org/#/c/253001
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-7514
- agent/trending
- agent/tags
- agent/source
- vendor/openstack
- canonical/openstack ironic
- version/openstack ironic/4.2.0
- version/openstack ironic/4.2.1