Every CVE Search/ Get API key

CVE-2016-4985

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

7.5 HighFix available

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.86%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
CVE-2016-4985
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
CVE-2016-4985
Updated
2026-11-02
EUVDEUVD-2022-3715 No score

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
EUVD-2022-3715
Updated
2026-11-03
GitHub AdvisoriesGHSA-f7cr-7c2c-fm8r 7.5

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
GHSA-f7cr-7c2c-fm8r
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
CVE-2016-4985
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-4985 7.5

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
DEBIAN-CVE-2016-4985
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-f7cr-7c2c-fm8r 7.5

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
GHSA-f7cr-7c2c-fm8r
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVPYSEC-2026-646 7.5

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
PYSEC-2026-646
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2016:1377 5.9

Red Hat Security Advisory: openstack-ironic security update

Record
RHSA-2016:1377
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2016:1378 5.9

Red Hat Security Advisory: openstack-ironic security update

Record
RHSA-2016:1378
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2016-4985 7.5

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Record
UBUNTU-CVE-2016-4985
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVSUSE-SU-2016:1966-1 No score

Security update for several openstack-components

This update provides the latest code from OpenStack Liberty for openstack-designate, -ironic, -neutron-vpnaas, -nova-docker, -sahara, -tempest and -trove.

Additionally the following security issue has been fixed:

openstack-ironic:

  • Mask password on agent lookup according to policy (bsc#984802, CVE-2016-4985)

For a detailed description of all changes, please refer to the changelog.

Record
SUSE-SU-2016:1966-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ironic
PyPI
 before 4.2.5
4.2.5
ironic
PyPI
 5.0 up to 5.1.2
5.1.2
ironic
Debian:12
 before 1:5.1.2-1
1:5.1.2-1
ironic
Debian:13
 before 1:5.1.2-1
1:5.1.2-1
ironic
Debian:14
 before 1:5.1.2-1
1:5.1.2-1
ironic
PyPI
 before 4.2.5, plus listed versions
0.0
4.2.5
ironic
PyPI
 before 4.2.5, 5.0 up to 5.1.2, plus listed versions
0.0
4.2.55.1.2
openstack-ironic
Red Hat:openstack:7::el7
 before 0:2015.1.2-4.el7ost
0:2015.1.2-4.el7ost
openstack-ironic-api
Red Hat:openstack:7::el7
 before 0:2015.1.2-4.el7ost
0:2015.1.2-4.el7ost
openstack-ironic-common
Red Hat:openstack:7::el7
 before 0:2015.1.2-4.el7ost
0:2015.1.2-4.el7ost
Show 18 moreShow less
Affected packages
PackageAffectedFixed
openstack-ironic-conductor
Red Hat:openstack:7::el7
 before 0:2015.1.2-4.el7ost
0:2015.1.2-4.el7ost
openstack-ironic
Red Hat:openstack:8::el7
 before 1:4.2.5-1.el7ost
1:4.2.5-1.el7ost
openstack-ironic-api
Red Hat:openstack:8::el7
 before 1:4.2.5-1.el7ost
1:4.2.5-1.el7ost
openstack-ironic-common
Red Hat:openstack:8::el7
 before 1:4.2.5-1.el7ost
1:4.2.5-1.el7ost
openstack-ironic-conductor
Red Hat:openstack:8::el7
 before 1:4.2.5-1.el7ost
1:4.2.5-1.el7ost
openstack-designate
SUSE:OpenStack Cloud 6
 before 1.0.3~a0~dev10-6.1
1.0.3~a0~dev10-6.1
openstack-designate-doc
SUSE:OpenStack Cloud 6
 before 1.0.3~a0~dev10-6.2
1.0.3~a0~dev10-6.2
openstack-ironic
SUSE:OpenStack Cloud 6
 before 4.2.5-6.1
4.2.5-6.1
openstack-ironic-doc
SUSE:OpenStack Cloud 6
 before 4.2.5-6.2
4.2.5-6.2
openstack-neutron-vpnaas
SUSE:OpenStack Cloud 6
 before 7.0.5~a0~dev3-6.1
7.0.5~a0~dev3-6.1
openstack-neutron-vpnaas-doc
SUSE:OpenStack Cloud 6
 before 7.0.5~a0~dev3-6.1
7.0.5~a0~dev3-6.1
openstack-nova-docker
SUSE:OpenStack Cloud 6
 before 0.0.1~a0~dev238-4.1
0.0.1~a0~dev238-4.1
openstack-sahara
SUSE:OpenStack Cloud 6
 before 3.0.3~a0~dev1-6.1
3.0.3~a0~dev1-6.1
openstack-sahara-doc
SUSE:OpenStack Cloud 6
 before 3.0.3~a0~dev1-6.1
3.0.3~a0~dev1-6.1
openstack-tempest
SUSE:OpenStack Cloud 6
 before 7.0.0-9.1
7.0.0-9.1
openstack-trove
SUSE:OpenStack Cloud 6
 before 4.0.1~a0~dev19-8.1
4.0.1~a0~dev19-8.1
openstack-trove-doc
SUSE:OpenStack Cloud 6
 before 4.0.1~a0~dev19-8.1
4.0.1~a0~dev19-8.1
ironic
Ubuntu:16.04:LTS
 before 1:5.1.2-0ubuntu1, plus listed versions
1:4.2.0-0ubuntu11:4.3.0-0ubuntu11:5.1.0-0ubuntu1
1:5.1.2-0ubuntu1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4985 is a high vulnerability (CVSS 7.5) in Canonical Openstack Ironic, published July 12, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in ironic 4.2.5.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open