PT-2016-6206 · Openstack · Openstack Ironic

Aeva Black + 2 · Publicado 2016-07-12 · Atualizado 2023-02-12 · CVE-2016-4985

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 4.2.5 (Liberty) OpenStack Ironic versions 5.x prior to 5.1.2 (Mitaka)

Description The issue allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the "v1/drivers/$DRIVER NAME/vendor passthru" resource.

Recommendations For OpenStack Ironic versions prior to 4.2.5 (Liberty), update to version 4.2.5 or later. For OpenStack Ironic versions 5.x prior to 5.1.2 (Mitaka), update to version 5.1.2 or later. As a temporary workaround, consider restricting access to the v1/drivers/$DRIVER NAME/vendor passthru resource until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-4985

GHSA-F7CR-7C2C-FM8R

RHSA-2016:1377

RHSA-2016:1378

SUSE-SU-2016:1966-1

Produtos afetados

Openstack Ironic

Referências · 27

• https://github.com/openstack/ironic · Nota
• https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e · Nota
• https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77 · Nota
• https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410 · Nota
• https://access.redhat.com/errata/RHSA-2016:1378 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-f7cr-7c2c-fm8r · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2016-4985 · Nota
• https://bugs.launchpad.net/ironic/+bug/1572796 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/06/21/6 · Nota
• https://review.openstack.org/332195 · Nota
• https://ubuntu.com/security/CVE-2016-4985 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-4985 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2016:1966-1 · Aviso do Fabricante
• https://marc.info/?l=oss-security&m=146654947532322&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4985 · Nota de Segurança