PT-2025-20397 · Openstack+1 · Openstack Ironic+1

Julia Kreger · Published 2025-05-08 · Updated 2025-05-08 · CVE-2025-44021

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 24.1.3 OpenStack Ironic versions prior to 26.1.1 OpenStack Ironic versions prior to 29.0.1

Description The issue allows a malicious project assigned as a node owner to provide a path to any local file readable by ironic-conductor, which may then be written to the target node disk during image handling via the API. This is particularly dangerous in environments with non-default, insecure configurations, such as those with automated cleaning disabled.

Recommendations For versions prior to 24.1.3, update to version 24.1.3 or later. For versions prior to 26.1.1, update to version 26.1.1 or later. For versions prior to 29.0.1, update to version 29.0.1 or later. As a temporary workaround, consider restricting access to the ironic-conductor service to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-44021

GHSA-Q3M2-CRGQ-5P3Q

PYSEC-2025-38

Affected Products

Debian

Openstack Ironic

References · 21

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-44021 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-38 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-44021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-44021 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-44021 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-44021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-44021 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-44021 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3m2-crgq-5p3q · Vendor Advisory
• https://github.com/openstack/ironic · Note
• https://github.com/openstack/ironic/commit/10590b36f541130f6a5d7a49da0f095ff8390cce · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ironic/PYSEC-2025-38.yaml · Note
• http://openwall.com/lists/oss-security/2025/05/08/1 · Note
• https://twitter.com/oss_security/status/1920552449598792171 · Twitter Post
• https://t.me/cvenotify/121474 · Telegram Post