Описание
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed.
Отчет
A flaw was found in OpenStack Ironic. When using the autodetect deploy interface, the cleaning step may be skipped immediately after a node is enrolled or when changing to the autodetect deploy interface. This could allow data from a previous tenant to remain on the hardware, potentially exposing sensitive information to subsequent tenants. This vulnerability was introduced in ironic version 32.0.0 and is fixed in versions 35.0.2 and 38.0.1.
Меры по смягчению последствий
Use an explicit deploy interface (such as 'direct' or 'iscsi') instead of the 'autodetect' deploy interface. Alternatively, manually trigger cleaning on nodes after enrollment or interface changes to ensure previous tenant data is removed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift4/ose-ironic-rhel9 | Fix deferred | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-ironic-api | Not affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-ironic-base | Not affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-ironic-conductor | Not affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-ironic-inspector | Not affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-ironic-pxe | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
Связанные уязвимости
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may ...
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
EPSS