VDB
KO
MEDIUM 6.8

GHSA-j4cw-mcg2-2q78

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Quick fix

GHSA-j4cw-mcg2-2q78 — ironic: upgrade to the fixed version with the command below. 

pip install --upgrade 'ironic>=29.0.6'

Details

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome is not a security issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / ironic
Introduced in: 17.0.0 Fixed in: 29.0.6
Fix pip install --upgrade 'ironic>=29.0.6'
PyPI / ironic
Introduced in: 30.0.0 Fixed in: 32.0.2
Fix pip install --upgrade 'ironic>=32.0.2'
PyPI / ironic
Introduced in: 33.0.0 Fixed in: 35.0.2
Fix pip install --upgrade 'ironic>=35.0.2'
PyPI / ironic
Introduced in: 36.0.0 Fixed in: 37.0.1
Fix pip install --upgrade 'ironic>=37.0.1'

References