CVE-2024-44082
published 2024-09-06CVE-2024-44082: In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.55%
42.5th percentile
In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: =22.0.0 =23.1.0 =25.0.0 =9.5.0 =9.8.0 =9.12.0 <9.13.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ironic | < ironic 1:26.1.0-1 (forky) | ironic 1:26.1.0-1 (forky) |
| debian | ironic-python-agent | < ironic 1:26.1.0-1 (forky) | ironic 1:26.1.0-1 (forky) |
| openstack | ironic | >= 0 < 1:26.1.0-1 | 1:26.1.0-1 |
| openstack | ironic | >= 0 < 1:26.1.0-1 | 1:26.1.0-1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenStack vulnerability
vendor_ubuntu·2024-09-04
CVE-2024-44082 OpenStack vulnerability
Title: OpenStack vulnerability
Summary: OpenStack could be made to expose sensitive information.
Dan Smith, Julia Kreger and Jay Faulkner discovered that in
image processing for Ironic, a specially crafted image
could be used by an authenticated user to exploit undesired behaviors
in qemu-img, including possible unauthorized access to potentially
sensitive data.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data
vendor_redhat·2024-09-04·CVSS 4.3
CVE-2024-44082 [MEDIUM] CWE-200 openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data
openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data
In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: =22.0.0 =23.1.0 =25.0.0 =9.5.0 =9.8.0 =9.12.0 <9.13.1.
A vulnerability was found in OpenStack Ironic. This flaw allows an authenticated user to use a specially crafted image to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data.
Statement: This vulnerability in OpenStack Iron
Debian
CVE-2024-44082: ironic - In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there i...
vendor_debian·2024·CVSS 4.3
CVE-2024-44082 [MEDIUM] CVE-2024-44082: ironic - In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there i...
In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: =22.0.0 =23.1.0 =25.0.0 =9.5.0 =9.8.0 =9.12.0 <9.13.1.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1:26.1.0-1)
sid: resolved (fixed in 1:26.1.0-1)
trixie: resolved (fixed in 1:26.1.0-1)
OSV
CVE-2024-44082: In OpenStack Ironic before 26
osv·2024-09-06·CVSS 4.3
CVE-2024-44082 [MEDIUM] CVE-2024-44082: In OpenStack Ironic before 26
In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: =22.0.0 =23.1.0 =25.0.0 =9.5.0 =9.8.0 =9.12.0 <9.13.1.
No detection rules found.
No public exploits indexed.
2024-09-06
Published