Lucene search

RedhatCVE-2019-10141

HistoryJul 30, 2019 - 5:15 p.m.

CVE-2019-10141

2019-07-3017:15:12

CWE-89

redhat

web.nvd.nist.gov

vulnerability

openstack-ironic-inspector

sql-injection

unauthenticated

network-based

denial of service

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector’s node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

Affected configurations

Nvd

Vulners

Node

openstackironic-inspectorRange<5.0.2

openstackironic-inspectorRange5.1.0–6.0.3

openstackironic-inspectorRange6.1.0–7.2.4

openstackironic-inspectorRange8.0.0–8.0.3

openstackironic-inspectorRange8.1.0–8.2.1

Node

redhatopenstackMatch10

redhatopenstackMatch13

redhatopenstackMatch14

Node

redhatenterprise_linuxMatch7.0

AND

redhatopenstackMatch9

VendorProductVersionCPE
openstackironic-inspector*cpe:2.3:a:openstack:ironic-inspector:*:*:*:*:*:*:*:*
redhatopenstack10cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
redhatopenstack13cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
redhatopenstack14cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
redhatopenstack9cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openstack	ironic-inspector	*	cpe:2.3:a:openstack:ironic-inspector::::::::
redhat	openstack	10	cpe:2.3:a:redhat:openstack:10:::::::*
redhat	openstack	13	cpe:2.3:a:redhat:openstack:13:::::::*
redhat	openstack	14	cpe:2.3:a:redhat:openstack:14:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	openstack	9	cpe:2.3:a:redhat:openstack:9:::::::*

CNA Affected

[
  {
    "product": "openstack-ironic-inspector",
    "vendor": "RedHat",
    "versions": [
      {
        "status": "affected",
        "version": "all 5.0.x up to, excluding 5.0.2"
      },
      {
        "status": "affected",
        "version": "all 6.0.x up to, excluding 6.0.3"
      },
      {
        "status": "affected",
        "version": "all 7.2.x up to, excluding 7.2.4"
      },
      {
        "status": "affected",
        "version": "all 8.0.3 up to, excluding 8.0.3"
      },
      {
        "status": "affected",
        "version": "8.2.0"
      }
    ]
  }
]