Описание
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
A flaw was found in OpenStack Ironic. An unauthenticated malicious user could exploit this vulnerability by submitting a specially crafted JSON (JavaScript Object Notation) string to certain API (Application Programming Interface) or JSON-RPC (Remote Procedure Call) service endpoints. This could lead to a service crash, resulting in a Denial of Service (DoS) for affected systems.
Меры по смягчению последствий
To reduce the risk of exploitation, restrict network access to the OpenStack Ironic API and JSON-RPC service endpoints. Configure firewall rules to permit connections only from trusted hosts and networks that require access to Ironic services. This operational control limits the attack surface by preventing unauthenticated remote attackers from reaching the vulnerable endpoints. A restart of the Ironic services may be required for firewall changes to take full effect, which could temporarily impact bare metal provisioning operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openstack-ironic | Affected | ||
| Red Hat OpenStack Platform 16.2 | openstack-ironic | Affected | ||
| Red Hat OpenStack Platform 17.1 | openstack-ironic | Affected | ||
| Red Hat OpenStack Platform 18.0 | openstack-ironic | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious use ...
In OpenStack Ironic 32 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
EPSS
7.5 High
CVSS3