id: PYSEC-2019-152
details: A vulnerability was found in openstack-ironic-inspector all versions excluding
  5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in
  openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query
  using unfiltered data from a server reporting inspection results (by a POST to the
  /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited
  by an attacker with access to the network on which ironic-inspector is listening.
  Because of how ironic-inspector uses the query results, it is unlikely that data
  could be obtained. However, the attacker could pass malicious data and create a
  denial of service.
affected:
- package:
    name: ironic-inspector
    ecosystem: PyPI
    purl: pkg:pypi/ironic-inspector
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 6.1.0
    - fixed: 7.2.4
    - introduced: 8.1.0
    - fixed: 8.2.1
    - introduced: "0"
    - fixed: 5.0.2
    - introduced: 5.1.0
    - fixed: 6.0.3
    - introduced: 8.0.0
    - fixed: 8.0.3
  versions:
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.3.0
  - 3.0.0
  - 3.1.0
  - 3.2.0
  - 3.2.1
  - 3.2.2
  - 3.3.0
  - 4.0.0
  - 4.1.0
  - 4.2.0
  - 4.2.1
  - 4.2.2
  - 5.0.0
  - 5.0.1
  - 5.1.0
  - 6.0.0
  - 6.0.1
  - 6.0.2
  - 6.1.0
  - 7.0.0
  - 7.1.0
  - 7.2.0
  - 7.2.1
  - 7.2.2
  - 7.2.3
  - 8.0.0
  - 8.0.1
  - 8.0.2
  - 8.1.0
  - 8.2.0
references:
- type: WEB
  url: 
    https://docs.openstack.org/releasenotes/ironic-inspector/ocata.html#relnotes-5-0-2-7-origin-stable-ocata
- type: WEB
  url: 
    https://docs.openstack.org/releasenotes/ironic-inspector/stein.html#relnotes-8-2-1-stable-stein
- type: WEB
  url: 
    https://docs.openstack.org/releasenotes/ironic-inspector/queens.html#relnotes-7-2-4-stable-queens
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141
- type: WEB
  url: 
    https://docs.openstack.org/releasenotes/ironic-inspector/rocky.html#relnotes-8-0-3-stable-rocky
- type: WEB
  url: 
    https://docs.openstack.org/releasenotes/ironic-inspector/pike.html#relnotes-6-0-3-4-stable-pike
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2019:2505
- type: ADVISORY
  url: https://github.com/advisories/GHSA-c7fc-cm7p-92r2
aliases:
- CVE-2019-10141
- GHSA-c7fc-cm7p-92r2
modified: "2021-07-05T00:01:21.998814Z"
published: "2019-07-30T17:15:00Z"