CVE-2024-31463

A vulnerability was found in Ironic-image. This issue occurs when setting IRONIC_REVERSE_PROXY_SETUP to ‘true’, which may allow unauthenticated local access to the Ironic API private port without authentication.

Mitigation

Below are two mitigations for this vulnerability:

1. Switch to using unix sockets for traffic between HTTPD and Ironic/Inspector (recommended). Set the variables IRONIC_PRIVATE_PORT and IRONIC_INSPECTOR_PRIVATE_PORT to the value unix.

OR

2. Temporarily stop using the reverse proxy mode (set IRONIC_REVERSE_PROXY_SETUP and INSPECTOR_REVERSE_PROXY_SETUP to false).