OpenStack Ironic Vulnerability: Lack of Checksum Validation in Image Source URLs
Summary
DEBIAN-CVE-2024-47211: In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to conver... Affects ironic versions < 1:26.1.0-1. Fixed in 1:26.1.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Ironic is a service that manages bare metal servers in a cloud environment. It allows users to provision and manage physical machines as if they were virtual machines. The service is crucial for organizations that require direct access to hardware for performance or compliance reasons. However, a recent vulnerability has been identified that affects versions of Ironic prior to 26.1.0, which could lead to security risks when handling image sources.
Vulnerability Detail
In OpenStack Ironic versions before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a critical vulnerability due to a lack of checksum validation for supplied image_source URLs. This issue arises when the service is configured to convert images to a raw format for streaming. Without proper validation, an attacker could potentially supply malicious image URLs, leading to unauthorized access or execution of harmful code.
How To Fix
Minimum fixed version
1:26.1.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ironicTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using untrusted image_source URLs and ensure that all image sources are from verified and secure locations until the package is updated.
Conclusion
The OpenStack Ironic vulnerability due to a lack of checksum validation poses significant security risks for users managing bare metal servers. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider implementing temporary workarounds and monitoring their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for ironic →
FAQ
The vulnerability could allow attackers to supply malicious image URLs, potentially leading to unauthorized access or execution of harmful code on the server.
You can check your version of Ironic by running the command 'ironic --version' in your terminal. If it is below 1:26.1.0-1, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application using the Vulert playground without any signup.
If immediate updates are not possible, ensure that you do not use untrusted image_source URLs and only use verified sources until you can apply the patch.
More information can be found in the official Debian CVE database or the OpenStack security advisories related to Ironic.
References
Related vulnerabilities
Recent vulnerabilities recorded for ironic.
