Metal3 Ironic Container 安全漏洞

The Metal3 Ironic Container is a file required to build Ironic images used by Metal3. A security vulnerability exists in Metal3 Ironic Container versions prior to 24.1.0, which stems from a vulnerability that allows an unauthenticated attacker to gain local access to the Ironic API...

Authentication flaw

ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listenin...

Metal3 Ironic Container 访问控制错误漏洞

The Metal3 Ironic Container is the file required to build Ironic images used by Metal3. An access control error vulnerability exists in Metal3 Ironic Container versions prior to capm3-v1.4.3, which stems from a vulnerability that allows an unauthenticated attacker to access Ironic APIs that are n...

Improper Authorization

github.com/metal3-io/baremetal-operator is vulnerable to Improper Authorization. The .htpasswd files that Ironic and Ironic-inspector store as ConfigMaps rather than secrets when they are installed within Baremetal Operator using the deploy.sh file that is supplied. Anyone with access to the...