Aller au contenu
en Se connecter
2.8 Faible

CVE-2025-44021 OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment…

Description

OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
Ironic 27 27 → < 29.0.1 29.0.1
Ironic 25 25 → < 26.1.1 26.1.1
Ironic 24 24 → < 24.1.3 24.1.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Ironic

Les 18 CVE de Ironic →
CVE-2026-90458 OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's… 5.4 Moyenne CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to… 5.0 Moyenne CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of… 4.3 Moyenne CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is… 6.3 Moyenne
Suivre cette CVE