Description
OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | ironic-inspector | 3.2.0-1 | — |
| Debian 12 | ironic-inspector | 3.2.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-director 7 | python-ironic-discoverd +2 | 1.1.0-8.el7ost | RHSA-2015:1929 |
| Red Hat OpenStack 6 | openstack-ironic-discoverd | 0.2.5-2.el7ost | RHSA-2015:2685 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ironic-inspector | < 2.2.2 | 2.2.2 | GHSA-x64g-wjmw-w328 |
| PyPI | ironic-inspector | < 2.3.0 | 2.3.0 | PYSEC-2015-28 |
| PyPI | python-ironic-inspector-client | < 0.2.5 | 0.2.5 | GHSA-x64g-wjmw-w328 |
Advisories 2
- RHSA-2015:2685 Red Hat Security Advisory: openstack-ironic-discoverd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:1929 Red Hat Security Advisory: openstack-ironic-discoverd security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2015:1929 vendor-advisory
- RHSA-2015:2685 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1273698
- https://bugs.launchpad.net/ironic-inspector/+bug/1506419