CVE-2016-4985
Fixed in a distro release EPSS 3%
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
Products: redhat openstack, canonical openstack_ironic
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ironic | 4.2.5 |
| PyPI | ironic | 5.1.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ironic | 1:5.1.2-1 |
| Debian 13 | ironic | 1:5.1.2-1 |
| Debian 14 | ironic | 1:5.1.2-1 |
| Red Hat openstack 7 | openstack-ironic | 0:2015.1.2-4.el7ost |
| Red Hat openstack 7 | openstack-ironic-api | 0:2015.1.2-4.el7ost |
| Red Hat openstack 7 | openstack-ironic-common | 0:2015.1.2-4.el7ost |
| Red Hat openstack 7 | openstack-ironic-conductor | 0:2015.1.2-4.el7ost |
| Red Hat openstack 8 | openstack-ironic | 1:4.2.5-1.el7ost |
| Red Hat openstack 8 | openstack-ironic-api | 1:4.2.5-1.el7ost |
| Red Hat openstack 8 | openstack-ironic-common | 1:4.2.5-1.el7ost |
| Red Hat openstack 8 | openstack-ironic-conductor | 1:4.2.5-1.el7ost |
| SUSE OpenStack Cloud 6 | openstack-designate | 1.0.3~a0~dev10-6.1 |
| SUSE OpenStack Cloud 6 | openstack-designate-doc | 1.0.3~a0~dev10-6.2 |
| SUSE OpenStack Cloud 6 | openstack-ironic | 4.2.5-6.1 |
| SUSE OpenStack Cloud 6 | openstack-ironic-doc | 4.2.5-6.2 |
| SUSE OpenStack Cloud 6 | openstack-neutron-vpnaas | 7.0.5~a0~dev3-6.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-vpnaas-doc | 7.0.5~a0~dev3-6.1 |
| SUSE OpenStack Cloud 6 | openstack-nova-docker | 0.0.1~a0~dev238-4.1 |
| SUSE OpenStack Cloud 6 | openstack-sahara | 3.0.3~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-sahara-doc | 3.0.3~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-tempest | 7.0.0-9.1 |
| SUSE OpenStack Cloud 6 | openstack-trove | 4.0.1~a0~dev19-8.1 |
| SUSE OpenStack Cloud 6 | openstack-trove-doc | 4.0.1~a0~dev19-8.1 |
| Ubuntu 16.04 LTS | ironic | 1:5.1.2-0ubuntu1 |