OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2026-50589 · ADVISORY
• access.redhat.com/security/cve/CVE-2026-50589 · WEB
• bugs.launchpad.net/ironic/+bug/2154288 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• openstack/ironic · PACKAGE
• pypa/advisory-database · WEB
• security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50589.json · WEB
• wiki.openstack.org/wiki/OSSN/OSSN-0099 · WEB
• openwall.com/lists/oss-security/2026/06/06/2 · WEB
• GitHub Advisory GHSA-q3g8-rjrx-59ph · ADVISORY

Lỗ hổng khác của ironic

• CVE-2026-54421TRUNG BÌNH 6.8In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return…
• CVE-2026-48681CAO 8.1OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
• CVE-2026-46447CAO 7.7OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info…
• CVE-2026-44919TRUNG BÌNH 6.5In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///…
• CVE-2026-42510CAO 7.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.