Ironic Python Agent
Monthly
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary code execution in OpenStack ironic-python-agent (IPA) versions 1.0.0 through 11.5.0 occurs because IPA runs grub-install from inside a chroot of the partition image it is deploying, so binaries supplied by a malicious image execute on the provisioning ramdisk. An attacker able to have a crafted partition image deployed can run code in the IPA context (typically root on the bare-metal node being provisioned). No public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records exploitation status as none, but the technical impact is rated total.
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary code execution in OpenStack ironic-python-agent (IPA) versions 1.0.0 through 11.5.0 occurs because IPA runs grub-install from inside a chroot of the partition image it is deploying, so binaries supplied by a malicious image execute on the provisioning ramdisk. An attacker able to have a crafted partition image deployed can run code in the IPA context (typically root on the bare-metal node being provisioned). No public exploit identified at time of analysis; EPSS is negligible (0.01%) and CISA SSVC records exploitation status as none, but the technical impact is rated total.