Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg2NGctd2ptdy13MzI4
Injection vulnerability that affects ironic-discoverd
OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Permalink: https://github.com/advisories/GHSA-x64g-wjmw-w328JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg2NGctd2ptdy13MzI4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 5 years ago
Updated: over 1 year ago
Identifiers: GHSA-x64g-wjmw-w328, CVE-2015-5306
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-5306
- https://access.redhat.com/errata/RHSA-2015:1929
- https://bugs.launchpad.net/ironic-inspector/+bug/1506419
- https://bugzilla.redhat.com/show_bug.cgi?id=1273698
- http://rhn.redhat.com/errata/RHSA-2015-2685.html
- https://opendev.org/openstack/ironic-inspector/commit/77d0052c5133034490386fbfadfdb1bdb49aa44f
- https://access.redhat.com/errata/RHSA-2015:2685
- https://access.redhat.com/security/cve/CVE-2015-5306
- https://github.com/advisories/GHSA-x64g-wjmw-w328
Affected Packages
pypi:python-ironic-inspector-client
Dependent packages: 6Dependent repositories: 47
Downloads: 21,836 last month
Affected Version Ranges: < 0.2.5
Fixed in: 0.2.5
All affected versions:
All unaffected versions: 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 2.0.0, 2.1.0, 2.1.1, 3.0.0, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.7.1, 4.8.0, 4.9.0, 5.0.0, 5.1.0