PT-2015-6843 · Openstack · Openstack Ironic Inspector

Garth Mollett · Published 2015-11-25 · Updated 2023-02-12 · CVE-2015-5306

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Ironic Inspector (affected versions not specified)

Description The issue allows remote attackers to access the Flask console and execute arbitrary Python code by triggering an error when debug mode is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-5306

GHSA-X64G-WJMW-W328

PYSEC-2015-28

RHSA-2015:1929

RHSA-2015:2685

Affected Products

Openstack Ironic Inspector

References · 16

• http://rhn.redhat.com/errata/RHSA-2015-2685.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1273698 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2015:1929 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x64g-wjmw-w328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5306 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5306 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5306 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5306 · Vendor Advisory
• https://bugs.launchpad.net/ironic-inspector/+bug/1506419 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ironic-inspector/PYSEC-2015-28.yaml · Note
• https://access.redhat.com/errata/RHSA-2015:2685 · Note
• https://access.redhat.com/security/cve/CVE-2015-5306 · Note
• https://opendev.org/openstack/ironic-inspector · Note
• https://opendev.org/openstack/ironic-inspector/commit/77d0052c5133034490386fbfadfdb1bdb49aa44f · Note