BareMetal-RAM-Dumper

BareMetal RAM Dumper A simple x86 bare-metal tool designed to boot from a disk/USB and dump the system's RAM directly to the booting medium. It relies on BIOS interrupts to boot and perform disk operations, and enters unreal mode to access memory above the 1MB barrier. Background: Cold Boot Attac...

[SECURITY] [DSA 6445-1] ironic security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6445-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 17, 2026 https://www.debian.org/security/faq -...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2026-50266 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2026-50266 Source advisory: OSV:PYSEC-2026-3491...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2023-3637 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2023-3637 Source advisory: OSV:PYSEC-2026-1694...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2022-3277 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2022-3277 Source advisory: OSV:PYSEC-2026-855...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2015-3221 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2015-3221 Source advisory: OSV:PYSEC-2026-856...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2017-7543 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2017-7543 Source advisory: OSV:PYSEC-2026-686...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2026-50266 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2026-50266 Source advisory: OSV:GHSA-QMC5-GV6V-8P...

networking-bagpipe (>=8.0.1, <=10.0.1), networking-baremetal (1.0.1) +8 more potentially affected by CVE-2026-50266 via neutron (>=12.1.1, <=15.3.4)

neutron PYPI version =12.1.1, =8.0.1, =15.0.0, =13.0.1, =5.1.0, =13.0.2, =13.0.2, =14.0.1, =14.3.0 Source cves: CVE-2026-50266 Source advisory: MEND:CVE-2026-50266...

PT-2026-47580

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

EUVD-2019-7903

Malware in sbrugna...

EUVD-2023-1258

Malicious code in bioql PyPI...

Secret Exfiltration

github.com/metal3-io/baremetal-operator is vulnerable to Secret Exfiltration. The vulnerability is due to BMO's ability to read Secrets from any namespace, which allows an attacker to exfiltrate Secrets from other namespaces by linking them to a BareMetalHost configuration...

Critical: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.8.5 security and bug fix container updates

Red Hat Advanced Cluster Management for Kubernetes 2.8.5 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

networking-bagpipe (8.0.1), networking-baremetal (1.0.1) +1 more potentially affected by CVE-2023-3637 via neutron (12.1.1)

neutron PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on neutron and may be impacted: - networking-bagpipe 8.0.1 - networking-baremetal 1.0.1 - networking-mlnx 12.4.0 Source cves: CVE-2023-3637 Source advisory: OSV:GHSA-R3JH-QHGJ-GVR...

Improper Authorization

github.com/metal3-io/baremetal-operator is vulnerable to Improper Authorization. The .htpasswd files that Ironic and Ironic-inspector store as ConfigMaps rather than secrets when they are installed within Baremetal Operator using the deploy.sh file that is supplied. Anyone with access to the...

CVE-2023-30841

A flaw was found in the baremetal-operator, where the ironic and ironic-inspector deployed within the baremetal operator using the included deploy.sh store .htpasswd files as ConfigMaps instead of Secrets. This issue causes the plain-text username and hashed password to be readable by anyone havi...

Ironic and ironic-inspector may expose as ConfigMaps

Impact Ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management...

CVE-2023-30841

Baremetal Operator BMO is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text usernam...

Default credentials

Baremetal Operator BMO is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text usernam...