REDHAT-BUG-1346193: Medium severity openstack ironic vulnerability
A client with network access to the ironic-api service can bypass Keystone authentication and retrieve all information about any Node registered with Ironic, if they know (or are able to guess) the MAC address of a network card belonging to that Node, by sending a crafted POST request to the /v1/drivers/$DRIVERNAME/vendorpassthru resource.
The response will include the full Node details, including management passwords, even when /etc/ironic/policy.json is configured to hide passwords in API responses.
This vulnerability has been verified in all currently supported branches (liberty, mitaka, master) and traced back to code introduced in commit 3e568fbbbcc5748035c1448a0bdb26306470797c during the Juno development cycle. Therefore, it is likely that both juno and kilo branches (and their releases) are also affected.
Affected versions: >=2014.2, >=4.0.0 <=4.2.4, >=4.3.0 <=5.1.1
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1346193?
The severity of REDHAT-BUG-1346193 is critical due to the potential for unauthorized access to sensitive information.
How do I fix REDHAT-BUG-1346193?
To fix REDHAT-BUG-1346193, update to the latest version of OpenStack Ironic that addresses this vulnerability.
Which versions of OpenStack Ironic are affected by REDHAT-BUG-1346193?
Versions of OpenStack Ironic from 2014.2 to 5.1.1 are affected by REDHAT-BUG-1346193.
What is the impact of REDHAT-BUG-1346193 on Ironic services?
REDHAT-BUG-1346193 allows attackers with network access to bypass authentication and access all Node information.
Who is at risk from the vulnerability REDHAT-BUG-1346193?
Clients with network access to the ironic-api service are at risk from the vulnerability REDHAT-BUG-1346193.