Description
In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ironic | 1:26.1.0-1 | — |
| Debian 13 | ironic | 1:26.1.0-1 | — |
| Debian 12 | ironic | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ironic | No fix yet | — |
| Ubuntu 26.04 LTS | ironic | No fix yet | — |
| Ubuntu 25.10 | ironic | No fix yet | — |
| Ubuntu 24.04 LTS | ironic | No fix yet | — |
| Ubuntu 22.04 LTS | ironic | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ironic | No fix yet | — |
| Ubuntu 18.04 LTS | ironic | No fix yet | — |
| Ubuntu 16.04 LTS | ironic | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 18 | openstack-ironic +3 | 1:21.4.5-18.0.20241207142602.9213ccd.el9ost | RHSA-2025:0439 |
| Red Hat OpenStack 17 | openstack-ironic +3 | 1:17.1.1-17.1.20241122190825.c31db88.el9ost | RHSA-2025:3482 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ironic | >= 25.0.0, < 26.1.1 | 26.1.1 | GHSA-8h22-6qwx-q4w9 |
| PyPI | ironic | >= 23.1.0, < 24.1.3 | 24.1.3 | GHSA-8h22-6qwx-q4w9 |
| PyPI | ironic | >= 22.0.0, < 23.0.3 | 23.0.3 | GHSA-8h22-6qwx-q4w9 |
| PyPI | ironic | <= 21.4.3 | — | GHSA-8h22-6qwx-q4w9 |
| PyPI | ironic | < 23.0.3 · >= 23.1.0, < 24.1.3 · >= 25.0.0, < 26.1.1 | 23.0.3, 24.1.3, 26.1.1 | PYSEC-2026-1468 |
Advisories 3
- RHSA-2025:3482 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-ironic) security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2025:0439 Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.4 (openstack-ironic) security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- WID-SEC-2025-0170 Red Hat OpenStack (ironic): Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Apr 7, 2025