CVE-2024-47211 OpenStack Ironic fails to verify checksums of supplied image_source URLs
Attackers can bypass integrity checks on image sources during raw format conversion, potentially serving malicious or corrupted data to bare metal nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47211?
CVE-2024-47211 is a medium-severity vulnerability in n/a, published on 4 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.
Which versions are affected by CVE-2024-47211?
9 open source packages ship an affected version, including ironic.
| Package | Affected | Fixed in |
|---|---|---|
ironic PyPI | All versions | 23.0.3, 24.1.3, 26.1.1 |
ironic PyPI | All versions to 21.4.3 | None |
ironic PyPI | All versions to 21.4.3 | None |
ironic PyPI | From 22.0.0 | 23.0.3 |
ironic PyPI | From 22.0.0 | 23.0.3 |
ironic PyPI | From 23.1.0 | 24.1.3 |
3 more packages
ironic PyPI | From 23.1.0 | 24.1.3 |
ironic PyPI | From 25.0.0 | 26.1.1 |
ironic PyPI | From 25.0.0 | 26.1.1 |
Linux distribution packages (8)
openstack-ironic Red Hat:openstack:17.1::el9 | All versions | 1:17.1.1-17.1.20241122190825.c31db88.el9ost |
openstack-ironic-api Red Hat:openstack:17.1::el9 | All versions | 1:17.1.1-17.1.20241122190825.c31db88.el9ost |
openstack-ironic-common Red Hat:openstack:17.1::el9 | All versions | 1:17.1.1-17.1.20241122190825.c31db88.el9ost |
openstack-ironic-conductor Red Hat:openstack:17.1::el9 | All versions | 1:17.1.1-17.1.20241122190825.c31db88.el9ost |
openstack-ironic Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20241207142602.9213ccd.el9ost |
openstack-ironic-api Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20241207142602.9213ccd.el9ost |
openstack-ironic-common Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20241207142602.9213ccd.el9ost |
openstack-ironic-conductor Red Hat:openstack:18.0::el9 | All versions | 1:21.4.5-18.0.20241207142602.9213ccd.el9ost |
How do I fix CVE-2024-47211?
Upgrade ironic to a fixed version for your release line: 23.0.3, 24.1.3 or 26.1.1.
Is CVE-2024-47211 being exploited?
There is no known exploitation of CVE-2024-47211 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-47211, GHSA-8h22-6qwx-q4w9, PYSEC-2026-1468, RHSA-2025:0439, RHSA-2025:3482, UBUNTU-CVE-2024-47211.