4.3

CVE-2024-44082: ironic Missing Authorization

CVSS: 4.3v3.1MediumDeferred
AliasesRHSA-2024:9982RHSA-2025:0204UBUNTU-CVE-2024-44082
Published 06-09-2024Last modified 06-11-2024
Open JSON

Vulnerability summary

CVE-2024-44082 is a medium (CVSS 4.3) Missing Authorization vulnerability in ironic. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities.

Overall risk
17/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.55%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2
RHSA-2024:7941RHSA-2024:8694

Timeline

  1. 06-09-2024
    PublishedVulnerability first disclosed.
  2. 06-11-2024
    Last modifiedVulnerability information updated.

Description

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

0.00 pp

From 0.55% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat4 products
  • openstack-ironic< 1:17.1.1-17.1.20240917210749.c31db88.el9ost | < 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-api< 1:17.1.1-17.1.20240917210749.c31db88.el9ost | < 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-common< 1:17.1.1-17.1.20240917210749.c31db88.el9ost | < 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-conductor< 1:17.1.1-17.1.20240917210749.c31db88.el9ost | < 1:13.0.8-2.20230713045150.d10fd5c.el8ost
Debian2 products
  • ironic< 1:21.4.4-0+deb12u1 | < 1:26.1.0-1
  • ironic-python-agent< 9.14.0-1
Ubuntu2 products
  • ironicAll versions (No fix recorded) | < 1:20.1.0-0ubuntu1.2 | < 1:24.1.1-0ubuntu1.2
  • ironic-python-agentAll versions (No fix recorded)

3 vendors · 8 products

References

15 links
Show all 15 references