CVE-2019-10141 Openstack ironic-inspector has SQL injection vulnerability in node_cache
An unauthenticated attacker can cause denial of service in OpenStack Ironic Inspector via SQL injection in the node cache lookup function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10141?
CVE-2019-10141 is a high-severity SQL injection vulnerability in Redhat Openstack, published on 30 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.
Weakness: CWE-89
Which versions are affected by CVE-2019-10141?
11 open source packages ship an affected version, including ironic-inspector. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
ironic-inspector PyPI | All versions | 5.0.2 |
ironic-inspector PyPI | All versions | 5.0.2 |
ironic-inspector PyPI | From 5.1.0 | 6.0.3 |
ironic-inspector PyPI | From 5.1.0 | 6.0.3 |
ironic-inspector PyPI | From 6.1.0 | 7.2.4, 8.2.1, 5.0.2, 6.0.3, 8.0.3 |
ironic-inspector PyPI | From 6.1.0 | 7.2.4 |
5 more packages
ironic-inspector PyPI | From 6.1.0 | 7.2.4 |
ironic-inspector PyPI | From 8.0.0 | 8.0.3 |
ironic-inspector PyPI | From 8.0.0 | 8.0.3 |
ironic-inspector PyPI | From 8.1.0 | 8.2.1 |
ironic-inspector PyPI | From 8.1.0 | 8.2.1 |
Linux distribution packages (5)
openstack-ironic-inspector Red Hat:openstack-director:9::el7 | All versions | 0:3.2.2-5.el7ost |
openstack-ironic-inspector-doc Red Hat:openstack-director:9::el7 | All versions | 0:3.2.2-5.el7ost |
openstack-ironic-inspector Red Hat:openstack:10::el7 | All versions | 0:4.2.2-6.el7ost |
openstack-ironic-inspector Red Hat:openstack:13::el7 | All versions | 0:7.2.3-3.el7ost |
openstack-ironic-inspector Red Hat:openstack:14::el7 | All versions | 0:8.0.3-0.20190420013817.el7ost |
Products include Openstack Ironic-Inspector, Redhat Openstack.
How do I fix CVE-2019-10141?
Upgrade ironic-inspector to a fixed version for your release line: 5.0.2, 6.0.3, 7.2.4 or 8.2.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-10141 being exploited?
There is no known exploitation of CVE-2019-10141 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-10141, GHSA-c7fc-cm7p-92r2, PYSEC-2019-152, RHSA-2019:1669, RHSA-2019:1722, RHSA-2019:1734 and 2 more.