CVE-2016-4985: Infoleak
First published: Tue Jun 14 2016(Updated: )
A client with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node, by sending a crafted POST request to the /v1/drivers/$DRIVER_NAME/vendor_passthru resource. The response will include the full Node details, including management passwords, even when /etc/ironic/policy.json is configured to hide passwords in API responses. This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748035c1448a0bdb26306470797c during the Juno development cycle. Therefore, it is likely that both juno and kilo branches (and their releases) are also affected. Affected versions: >=2014.2, >=4.0.0 <=4.2.4, >=4.3.0 <=5.1.1
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Openstack | =7.0 | |
| Redhat Openstack | =8 | |
| Canonical Openstack Ironic | <=4.2.4 | |
| Canonical Openstack Ironic | =5.1.0 | |
| Canonical Openstack Ironic | =5.1.1 | |
| pip/ironic | >=5.0<5.1.2 | 5.1.2 |
| pip/ironic | <4.2.5 | 4.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2016/06/21/6
- https://access.redhat.com/errata/RHSA-2016:1377
- https://access.redhat.com/errata/RHSA-2016:1378
- https://bugs.launchpad.net/ironic/+bug/1572796
- https://review.openstack.org/332195
- https://review.openstack.org/332196
- https://review.openstack.org/332197
- http://seclists.org/oss-sec/2016/q2/579
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1348817
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1348818
- https://bugzilla.redhat.com/show_bug.cgi?id=1346193
- https://nvd.nist.gov/vuln/detail/CVE-2016-4985
- https://access.redhat.com/security/cve/CVE-2016-4985
- https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410
- https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e
- https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77
- https://github.com/advisories/GHSA-f7cr-7c2c-fm8r (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-4985
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f7cr-7c2c-fm8r
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/redhat
- canonical/redhat openstack
- version/redhat openstack/7.0
- version/redhat openstack/8
- vendor/canonical
- canonical/canonical openstack ironic
- version/canonical openstack ironic/4.2.4
- version/canonical openstack ironic/5.1.0
- version/canonical openstack ironic/5.1.1
- package-manager/pip