CVE-2024-44082 Information disclosure in n/a

Q: Is CVE-2024-44082 being exploited?

There is no known exploitation of CVE-2024-44082 in the wild and no public exploit code.

Medium 4.3 Published 6 Sep 2024 Updated 6 Nov 2024

An authenticated user can exploit crafted images to access sensitive data via qemu-img in OpenStack Ironic.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-44082?

CVE-2024-44082 is a medium-severity vulnerability in n/a, published on 6 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1.

Weakness: CWE-862

Which versions are affected by CVE-2024-44082?

Linux distribution packages (8)

`openstack-ironic` Red Hat:openstack:16.2::el8	All versions	`1:13.0.8-2.20230713045150.d10fd5c.el8ost`
`openstack-ironic-api` Red Hat:openstack:16.2::el8	All versions	`1:13.0.8-2.20230713045150.d10fd5c.el8ost`
`openstack-ironic-common` Red Hat:openstack:16.2::el8	All versions	`1:13.0.8-2.20230713045150.d10fd5c.el8ost`
`openstack-ironic-conductor` Red Hat:openstack:16.2::el8	All versions	`1:13.0.8-2.20230713045150.d10fd5c.el8ost`
`openstack-ironic` Red Hat:openstack:17.1::el9	All versions	`1:17.1.1-17.1.20240917210749.c31db88.el9ost`
`openstack-ironic-api` Red Hat:openstack:17.1::el9	All versions	`1:17.1.1-17.1.20240917210749.c31db88.el9ost`
`openstack-ironic-common` Red Hat:openstack:17.1::el9	All versions	`1:17.1.1-17.1.20240917210749.c31db88.el9ost`
`openstack-ironic-conductor` Red Hat:openstack:17.1::el9	All versions	`1:17.1.1-17.1.20240917210749.c31db88.el9ost`

How do I fix CVE-2024-44082?

Upgrade to a fixed version.

Is CVE-2024-44082 being exploited?