{"id":"CVE-2015-5306","aliases":["DEBIAN-CVE-2015-5306","EUVD-2015-0025","GHSA-x64g-wjmw-w328","PYSEC-2015-28","PYSEC-2026-505","RHSA-2015:1929","RHSA-2015:2685"],"status":"published","title":"Injection vulnerability that affects ironic-discoverd","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01598,"percentile":0.75932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254"],"published":"2015-11-25T20:00:00Z","modified":"2026-09-09T06:47:30Z","fixes":[{"ecosystem":"PyPI","package":"python-ironic-inspector-client","fixed_in":["0.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"ironic-inspector","fixed_in":["2.2.2","2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ironic-inspector","fixed_in":["3.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ironic-inspector","fixed_in":["3.2.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-director:7::el7","package":"openstack-ironic-discoverd","fixed_in":["0:1.1.0-8.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-director:7::el7","package":"openstack-ironic-discoverd-ramdisk","fixed_in":["0:1.1.0-8.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-director:7::el7","package":"python-ironic-discoverd","fixed_in":["0:1.1.0-8.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-ironic-discoverd","fixed_in":["0:0.2.5-2.el7ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-ironic-inspector-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"ironic-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ironic-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ironic-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-ironic-inspector-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ironic-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.2.0","2.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"ironic-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7"]},{"source":"osv","ecosystem":"PyPI","package":"python-ironic-inspector-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-director:7::el7","package":"openstack-ironic-discoverd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-8.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-director:7::el7","package":"openstack-ironic-discoverd-ramdisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-8.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-director:7::el7","package":"python-ironic-discoverd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-8.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-ironic-discoverd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.5-2.el7ost"}]}]}],"products":[{"vendor":"openstack","product":"ironic_inspector"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2015:1929","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2685.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1273698","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://bugs.launchpad.net/ironic-inspector/+bug/1506419","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5306","tags":["advisory"]},{"url":"https://opendev.org/openstack/ironic-inspector/commit/77d0052c5133034490386fbfadfdb1bdb49aa44f","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2685","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5306","tags":["web","report"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ironic-inspector/PYSEC-2015-28.yaml","tags":["web"]},{"url":"https://opendev.org/openstack/ironic-inspector/commit/2c64da2bee6eeea27c08eb7a94894feaa5494910","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x64g-wjmw-w328","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5306","tags":["advisory"]},{"url":"https://opendev.org/openstack/ironic-inspector","tags":["package"]},{"url":"https://pypi.org/project/python-ironic-inspector-client","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1256421","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1929.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5306","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2685.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-5306","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:00:00Z","modified":"2024-08-06T06:41:09.264Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-0025","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-x64g-wjmw-w328","title":"Injection vulnerability that affects ironic-discoverd","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2019-07-05T21:10:52Z","modified":"2024-09-24T18:37:59Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2015-5306","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:59:06.273Z","modified":"2026-06-17T00:28:53.75Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:14.501367Z"}],"osv":[{"id":"GHSA-x64g-wjmw-w328","title":"Injection vulnerability that affects ironic-discoverd","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2019-07-05T21:10:52Z","modified":"2026-06-29T12:26:25.775279595Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"PYSEC-2026-505","title":"Injection vulnerability that affects ironic-discoverd","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2026-06-29T11:50:52.950837Z","modified":"2026-07-01T20:23:03.228458Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"CVE-2015-5306","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:59:06Z","modified":"2026-06-29T12:26:25.775279595Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5306","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:59:06.273Z","modified":"2026-09-09T06:47:30.996881309Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"PYSEC-2015-28","description":"OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.","status":"published","published":"2015-11-25T20:59:00Z","modified":"2026-06-29T12:26:25.775279595Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2015:1929","title":"Red Hat Security Advisory: openstack-ironic-discoverd security update","status":"published","published":"2024-09-15T22:55:34Z","modified":"2025-11-22T11:04:31Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2685","title":"Red Hat Security Advisory: openstack-ironic-discoverd security update","status":"published","published":"2024-09-15T22:55:30Z","modified":"2025-11-22T11:06:24Z","updated_at":"2026-11-02T15:53:03.182161Z"}]}}