Every CVE Search/ Get API key

CVE-2024-47211

OpenStack Ironic fails to verify checksums of supplied image_source URLs

5.3 MediumFix available

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.66%Up 0.6 points since Oct 5, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
CVE-2024-47211
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
EUVDEUVD-2024-2993 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
EUVD-2024-2993
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-8h22-6qwx-q4w9 6.9

OpenStack Ironic fails to verify checksums of supplied image_source URLs

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
GHSA-8h22-6qwx-q4w9
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-354
Updated
2026-11-02
NVD 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
CVE-2024-47211
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
CVE-2024-47211
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2024-47211 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
DEBIAN-CVE-2024-47211
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-8h22-6qwx-q4w9 6.9

OpenStack Ironic fails to verify checksums of supplied image_source URLs

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
GHSA-8h22-6qwx-q4w9
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-354
Updated
2026-11-02
OSVPYSEC-2026-1468 6.9

OpenStack Ironic fails to verify checksums of supplied image_source URLs

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
PYSEC-2026-1468
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:0439 6.3

Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.4 (openstack-ironic) security update

Record
RHSA-2025:0439
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:3482 6.3

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-ironic) security update

Record
RHSA-2025:3482
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-47211 5.3

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

Record
UBUNTU-CVE-2024-47211
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
ironic
PyPI
 25.0.0 up to 26.1.1
26.1.1
ironic
PyPI
 23.1.0 up to 24.1.3
24.1.3
ironic
PyPI
 22.0.0 up to 23.0.3
23.0.3
ironic
PyPI
 through 21.4.3 None known
ironic
Debian:12
 All versions, plus listed versions
1:21.1.0-31:21.1.0-3+deb12u11:21.3.0-11:21.4.0-11:21.4.0-2
Show 45 moreShow less
1:21.4.0-31:21.4.0-41:21.4.4-0+deb12u11:21.4.4-0+deb12u21:22.1.0-11:23.0.0-11:23.0.0-21:23.0.0-31:23.0.0-41:24.0.0-11:24.1.0-11:24.1.1-11:24.1.1-21:24.1.1-31:26.0.0-11:26.0.0-21:26.1.0-11:26.1.0-21:26.1.0-31:26.1.1-11:26.1.1-21:26.1.1-31:26.1.1-41:29.0.0-11:29.0.0-21:29.0.0-31:29.0.0-41:29.0.0-51:29.0.0-61:29.0.0-71:32.0.0-11:32.0.0-21:32.0.0-41:32.0.0-51:32.0.0-61:32.0.0-71:34.0.0-11:35.0.0-11:35.0.0-21:35.0.1-11:35.0.1-101:35.0.1-21:35.0.1-31:35.0.1-51:35.0.1-6
 None known
ironic
Debian:13
 before 1:26.1.0-1
1:26.1.0-1
ironic
Debian:14
 before 1:26.1.0-1
1:26.1.0-1
ironic
PyPI
 25.0.0 up to 26.1.1, plus listed versions
26.0.026.1.0
26.1.1
ironic
PyPI
 23.1.0 up to 24.1.3, plus listed versions
24.0.024.1.024.1.124.1.2
24.1.3
ironic
PyPI
 22.0.0 up to 23.0.3, plus listed versions
22.1.023.0.023.0.123.0.2
23.0.3
Show 18 moreShow less
Affected packages
PackageAffectedFixed
ironic
PyPI
 through 21.4.3, plus listed versions
0.010.1.1010.1.710.1.810.1.9
Show 45 moreShow less
11.1.111.1.211.1.311.1.412.0.012.1.012.1.112.1.212.1.312.1.412.1.512.1.612.2.013.0.013.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.015.0.015.0.115.0.215.1.015.2.016.0.016.0.116.0.216.0.316.0.416.0.516.1.016.2.017.0.017.0.117.0.217.0.317.0.417.1.018.0.018.1.018.2.018.2.1
 None known
ironic
PyPI
 before 23.0.3, 23.1.0 up to 24.1.3, 25.0.0 up to 26.1.1, plus listed versions
0.010.1.1010.1.710.1.810.1.9
Show 45 moreShow less
11.1.111.1.211.1.311.1.412.0.012.1.012.1.112.1.212.1.312.1.412.1.512.1.612.2.013.0.013.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.015.0.015.0.115.0.215.1.015.2.016.0.016.0.116.0.216.0.316.0.416.0.516.1.016.2.017.0.017.0.117.0.217.0.317.0.417.1.018.0.018.1.018.2.018.2.1
23.0.324.1.326.1.1
openstack-ironic
Red Hat:openstack:18.0::el9
 before 1:21.4.5-18.0.20241207142602.9213ccd.el9ost
1:21.4.5-18.0.20241207142602.9213ccd.el9ost
openstack-ironic-api
Red Hat:openstack:18.0::el9
 before 1:21.4.5-18.0.20241207142602.9213ccd.el9ost
1:21.4.5-18.0.20241207142602.9213ccd.el9ost
openstack-ironic-common
Red Hat:openstack:18.0::el9
 before 1:21.4.5-18.0.20241207142602.9213ccd.el9ost
1:21.4.5-18.0.20241207142602.9213ccd.el9ost
openstack-ironic-conductor
Red Hat:openstack:18.0::el9
 before 1:21.4.5-18.0.20241207142602.9213ccd.el9ost
1:21.4.5-18.0.20241207142602.9213ccd.el9ost
openstack-ironic
Red Hat:openstack:17.1::el9
 before 1:17.1.1-17.1.20241122190825.c31db88.el9ost
1:17.1.1-17.1.20241122190825.c31db88.el9ost
openstack-ironic-api
Red Hat:openstack:17.1::el9
 before 1:17.1.1-17.1.20241122190825.c31db88.el9ost
1:17.1.1-17.1.20241122190825.c31db88.el9ost
openstack-ironic-common
Red Hat:openstack:17.1::el9
 before 1:17.1.1-17.1.20241122190825.c31db88.el9ost
1:17.1.1-17.1.20241122190825.c31db88.el9ost
openstack-ironic-conductor
Red Hat:openstack:17.1::el9
 before 1:17.1.1-17.1.20241122190825.c31db88.el9ost
1:17.1.1-17.1.20241122190825.c31db88.el9ost
ironic
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:4.2.0-0ubuntu11:4.3.0-0ubuntu11:5.1.0-0ubuntu11:5.1.2-0ubuntu1
 None known
ironic
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:9.1.0-0ubuntu21:9.2.0-0ubuntu11:10.0.0-0ubuntu11:10.1.0-0ubuntu11:10.1.1-0ubuntu11:10.1.1-0ubuntu2
 None known
ironic
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:13.0.1-0ubuntu11:14.0.0~b1~git2019121713.76597ca93-0ubuntu11:14.0.0~b1~git2019121713.76597ca93-0ubuntu21:14.0.0-0ubuntu11:14.0.1~git2020032415.de2d907fc-0ubuntu11:14.0.1~git2020041013.af9e6ba90-0ubuntu21:15.0.0-0ubuntu0.20.04.1
 None known
ironic
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:18.2.0-0ubuntu11:18.2.0+git2021120910.cdc3b9538-0ubuntu11:19.0.0+git2022011216.7beadee46-0ubuntu11:20.0.0+git2022030313.4e6a3d52e-0ubuntu11:20.1.0-0ubuntu11:20.1.0-0ubuntu1.11:20.1.0-0ubuntu1.21:20.1.0-0ubuntu1.3
 None known
ironic
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:23.0.0-0ubuntu31:23.1.0+git2024011916.a374a0c1-0ubuntu11:24.1.0-0ubuntu11:24.1.1-0ubuntu11:24.1.1-0ubuntu1.21:24.1.1-0ubuntu1.3
 None known
ironic
Ubuntu:25.10
 All versions, plus listed versions
1:29.0.0-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu21:32.0.0-0ubuntu11:32.0.0-0ubuntu1.1
 None known
ironic
Ubuntu:26.10
 All versions, plus listed versions
1:35.0.0-0ubuntu21:35.0.0-0ubuntu31:38.0.0+git20260818.101.f8e78b0-0ubuntu11:38.0.0+git2026091517.26c022f13-0ubuntu11:39.0.0-0ubuntu1
 None known
ironic
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:32.0.0-0ubuntu11:34.0.0-0ubuntu11:35.0.0-0ubuntu11:35.0.0-0ubuntu21:35.0.0-0ubuntu2.1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47211 is a medium vulnerability (CVSS 5.3) in ironic, published October 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in ironic 26.1.1.

References

Show 17 moreShow less
This page doesn't list everything

Left out here: 65 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open