Packages / Debian 12 (Bookworm) / Source / net / ironic
bare metal hypervisor API for OpenStack - API server
bare metal hypervisor API for OpenStack - common files
bare metal hypervisor API for OpenStack - conductor
bare metal hypervisor API for OpenStack - doc
bare metal hypervisor API for OpenStack - Python lib
Die Paketzuordnung läuft.
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-90458] ironic: CVE-2026-90458 | Medium(5.4) | BetroffenDetails (20)
|
| [CVE-2026-89419] ironic: CVE-2026-89419 | Medium(5) | BetroffenDetails (20)
|
| [CVE-2026-115638] ironic: CVE-2026-115638 | Medium(4.3) | BetroffenDetails (20)
|
| [CVE-2026-90461] OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. | Medium(6.3) | BetroffenDetails (20)
|
| [CVE-2026-74250] In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. | Medium(6.3) | BetroffenDetails (20)
|
| [CVE-2026-71201] In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project. | Medium(5) | BetroffenDetails (20)
|
| [CVE-2026-54423] In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, | High(8.2) | BetroffenDetails (20)
|
| [CVE-2026-44918] OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. | High(8.7) | BetroffenDetails (20)
|
| [CVE-2026-54421] In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials | Medium(6.8) | BetroffenDetails (20)
|
| [CVE-2026-43003] An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading t | High(8.5) | BetroffenDetails (20)
|
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-50589] In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash. | Medium(5.3) | Nicht betroffenDetails (20)
|
| [CVE-2026-48681] OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. | Medium(5.9) | BehobenDetails (20)
|
| [CVE-2026-44917] OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template. | Medium(4.9) | BehobenDetails (20)
|
| [CVE-2026-46447] OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info. | Medium(5.8) | BehobenDetails (20)
|
| [CVE-2026-44919] In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL. | Medium(4.3) | BehobenDetails (20)
|
| [CVE-2026-44916] In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing. | Low(3) | BehobenDetails (20)
|
| [CVE-2026-42997] An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-l | High(7.7) | BehobenDetails (20)
|
| [CVE-2026-42510] OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface. | Medium(6.6) | BehobenDetails (20)
|
| [CVE-2015-7514] ironic: CVE-2015-7514 | Medium | BehobenDetails (20)
|
| [CVE-2016-4985] ironic: CVE-2016-4985 | Medium(5.9) | BehobenDetails (20)
|
Zuletzt synchronisiert:
Authoritative source; repository metadata signature verified
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Authoritative source; repository metadata signature verified
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Authoritative source; repository metadata signature verified
bookworm-security-main-amd64:f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Authoritative source; repository metadata signature verified
bookworm-security-main-arm64:f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14