CVE-2024-44082: [OSSA-2024-003] OpenStack Ironic: Unvalidated image data passed to qemu-img (CVE-2024-44082)
In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1.
Other sources
It was learned by the OpenStack community that running qemu-img on untrusted images without a format pre-specified can present a security risk. Furthermore, some of these specific image formats have inherently unsafe features. This is rooted in how qemu-img operates where all image drivers are loaded and attempt to evaluate the input data.
— Red Hat
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44082?
CVE-2024-44082 is considered a moderate severity vulnerability due to the potential for unauthorized access related to crafted images.
How do I fix CVE-2024-44082?
To mitigate CVE-2024-44082, upgrade to OpenStack Ironic version 26.0.1 or higher and ironic-python-agent version 9.13.1 or higher.
Who is affected by CVE-2024-44082?
CVE-2024-44082 affects users of OpenStack Ironic before version 26.0.1 and ironic-python-agent versions prior to 9.13.1.
What are the potential risks of CVE-2024-44082?
The risks associated with CVE-2024-44082 include unauthorized access and exploitation of vulnerabilities in image processing via qemu-img.
When was CVE-2024-44082 disclosed?
CVE-2024-44082 was disclosed in 2024 as part of an ongoing security review process for OpenStack components.