In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.
Vulnerabilidades de OpenStack ironic-python-agent (CVE)
Registros CVE publicados para OpenStack ironic-python-agent, los más recientes primero. Siga el producto para recibir un correo con cada nueva.
7.2Alta
OpenStack Ironic Python Agent
5.5Media
OpenStack Ironic Python Agent
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.
8.0Alta
OpenStack ironic-python-agent; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat Red Hat OpenShift Container Platform 4.20; Red Hat Red Hat OpenShift Container Platform 4.21
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image.