7.7Hoch
CVE-2026-42997
Beschreibung
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| OpenStack | Ironic | 17.0.0 – < 26.1.6, 27.0.0 – < 29.0.5, 30.0.0 – < 32.0.1, 33.0.0 – < 35.0.1 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | all versions | |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | |
| Red Hat | Red Hat OpenStack Platform 17.1 | all versions | |
| Red Hat | Red Hat OpenStack Platform 18.0 | all versions |
Referenzen und Patches
- https://www.openwall.com/lists/oss-security/2026/05/05/10 Mailing ListPatchThird Party Advisory
- https://security.openstack.org/ossa/OSSA-2026-010.html PatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/05/10 Mailing ListPatchThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:39811
- https://access.redhat.com/security/cve/CVE-2026-42997
- https://bugzilla.redhat.com/show_bug.cgi?id=2466844
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42997.json
CPE-Treffer (NVD) (4)
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*≥ 17.0.0 < 26.1.6cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*≥ 27.0.0 < 29.0.5cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*≥ 30.0.0 < 32.0.1cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*≥ 33.0.0 < 35.0.1