CVE-2016-4985: Infoleak
A client with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node, by sending a crafted POST request to the /v1/drivers/$DRIVERNAME/vendorpassthru resource.
The response will include the full Node details, including management passwords, even when /etc/ironic/policy.json is configured to hide passwords in API responses.
This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748035c1448a0bdb26306470797c during the Juno development cycle. Therefore, it is likely that both juno and kilo branches (and their releases) are also affected.
Affected versions: >=2014.2, >=4.0.0 <=4.2.4, >=4.3.0 <=5.1.1
Other sources
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVERNAME/vendorpassthru resource.
— GitHub
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVERNAME/vendorpassthru resource.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4985?
CVE-2016-4985 is considered a critical vulnerability due to the ability for an unauthenticated client to access sensitive information about registered nodes.
How do I fix CVE-2016-4985?
To fix CVE-2016-4985, upgrade the Ironic package to version 5.1.2 or 4.2.5 or later.
Who is affected by CVE-2016-4985?
CVE-2016-4985 affects users of Redhat Openstack versions 7.0 and 8, as well as Canonical Openstack Ironic versions up to 4.2.4 and specific 5.1.0 and 5.1.1 versions.
What type of attack does CVE-2016-4985 enable?
CVE-2016-4985 enables unauthorized users to bypass Keystone authentication and retrieve sensitive information about nodes.
What components of Openstack are impacted by CVE-2016-4985?
CVE-2016-4985 impacts the ironic-api service within Openstack.