Fluid Attacks Database

Description

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	ironic	=1:29.0.0-7 \|\| =1:32.0.0-1 \|\| =1:32.0.0-2 \|\| =1:32.0.0-4 \|\| =1:32.0.0-5 \|\| =1:32.0.0-6 \|\| =1:32.0.0-7 \|\| =1:34.0.0-1 \|\| =1:35.0.0-1 \|\| =1:35.0.0-2 \|\| =1:35.0.1-1 \|\| >=0 <1:35.0.1-2	1:35.0.1-2
debian 13	ironic	=1:29.0.0-7 \|\| >=0 <1:29.0.5-0+deb13u1	1:29.0.5-0+deb13u1
debian 12	ironic	=1:21.1.0-3 \|\| >=0 <1:21.1.0-3+deb12u1	1:21.1.0-3+deb12u1

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.