—

PYSEC-2015-28

Quick fix

PYSEC-2015-28 — ironic-inspector: upgrade to the fixed version with the command below.

pip install --upgrade 'ironic-inspector>=2.3.0'

Details

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/ironic-inspector

Introduced in: 0Fixed in: 2.3.0

Fixpip install --upgrade 'ironic-inspector>=2.3.0'

References

https://bugzilla.redhat.com/show_bug.cgi?id=1273698[REPORT]
https://bugs.launchpad.net/ironic-inspector/+bug/1506419[WEB]
https://access.redhat.com/errata/RHSA-2015:1929[ADVISORY]
http://rhn.redhat.com/errata/RHSA-2015-2685.html[ADVISORY]
https://github.com/advisories/GHSA-x64g-wjmw-w328[ADVISORY]