Skip to content
Fencer Vulns
medium 4.3

CVE-2024-44082 json

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted i…

published 2024-09-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-40852

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1.

Patch / fix

  • ironic Debian 12 1:21.4.4-0+deb12u1
  • ironic Debian 14, Debian 13 1:26.1.0-1
  • ironic-python-agent Debian 14, Debian 13 9.14.0-1

debian advisories DEBIAN-CVE-2024-44082

  • ironic Ubuntu 22.04 LTS 1:20.1.0-0ubuntu1.2
  • ironic Ubuntu 24.04 LTS 1:24.1.1-0ubuntu1.2

ubuntu advisories UBUNTU-CVE-2024-44082

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openstack-ironic openstack 16.2 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-api openstack 16.2 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-common openstack 16.2 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic-conductor openstack 16.2 1:13.0.8-2.20230713045150.d10fd5c.el8ost
  • openstack-ironic openstack 17.1 1:17.1.1-17.1.20240917210749.c31db88.el9ost
  • openstack-ironic-api openstack 17.1 1:17.1.1-17.1.20240917210749.c31db88.el9ost
  • openstack-ironic-common openstack 17.1 1:17.1.1-17.1.20240917210749.c31db88.el9ost
  • openstack-ironic-conductor openstack 17.1 1:17.1.1-17.1.20240917210749.c31db88.el9ost

red hat advisories RHSA-2025:0204RHSA-2024:9982RHSA-2024:8694RHSA-2024:7941

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-44082 updated cvss 6.8

openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data

  • Red Hat OpenStack Platform 16.1 openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 18.0 openstack-ironic
    affected: workaround, no fix available
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 openstack-ironic 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-api 21.0.1-0.20240913135525.114badc.el9, python3-ironic-tests 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-common 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-conductor 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-dnsmasq-tftp-server 21.0.1-0.20240913135525.114badc.el9
    fixed: vendor fix RHSA-2024:8694
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-api 21.3.1-0.20240911165036.c0d61d0.el9, python3-ironic-tests 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-common 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-conductor 21.3.1-0.20240911165036.c0d61d0.el9, openstack-ironic-dnsmasq-tftp-server 21.3.1-0.20240911165036.c0d61d0.el9
    fixed: vendor fix RHSA-2024:7941
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ironic-rhel9 v4.14.0-202410111109.p0.g0b1212c.assembly.stream.el9
    fixed: vendor fix RHSA-2024:8235
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9 v4.15.0-202410011835.p0.gcff728e.assembly.stream.el9
    fixed: vendor fix RHSA-2024:7594
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-ironic-rhel9 v4.16.0-202409202304.p0.gdd19aa0.assembly.stream.el9
    fixed: vendor fix RHSA-2024:7174
  • Red Hat OpenStack Platform 16.2 openstack-ironic 13.0.8-2.20230713045150.d10fd5c.el8ost, openstack-ironic-api 13.0.8-2.20230713045150.d10fd5c.el8ost, openstack-ironic-common 13.0.8-2.20230713045150.d10fd5c.el8ost, openstack-ironic-conductor 13.0.8-2.20230713045150.d10fd5c.el8ost
    fixed: vendor fix RHSA-2025:0204
show 2 more
  • Red Hat OpenStack Platform 17.1 openstack-ironic 17.1.1-17.1.20240917210749.c31db88.el9ost, openstack-ironic-api 17.1.1-17.1.20240917210749.c31db88.el9ost, openstack-ironic-common 17.1.1-17.1.20240917210749.c31db88.el9ost, openstack-ironic-conductor 17.1.1-17.1.20240917210749.c31db88.el9ost
    fixed: vendor fix RHSA-2024:9982
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 python3-ironic-python-agent 9.0.1-0.20240913135525.2b2dd8f.el9, openstack-ironic-python-agent 9.0.1-0.20240913135525.2b2dd8f.el9, python3-ironic-python-agent-tests 9.0.1-0.20240913135525.2b2dd8f.el9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 python-webob 1.8.8-2.el9, python3-webob 1.8.8-2.el9, python3-ironic-python-agent 9.3.1-0.20240911165036.dfceb59.el9, openstack-ironic-python-agent 9.3.1-0.20240911165036.dfceb59.el9, python3-ironic-python-agent-tests 9.3.1-0.20240911165036.dfceb59.el9 Red Hat OpenShift Container Platform 4.12 cri-tools 1.25.0-5.el8, cri-tools 1.25.0-5.el9, runc 1.1.6-9.rhaos4.12.el8, conmon 2.1.2-8.rhaos4.12.el8, conmon 2.1.2-9.rhaos4.12.el9, podman 4.4.1-8.rhaos4.12.el8, +62 more Red Hat OpenShift Container Platform 4.13 perf 5.14.0-284.88.1.el9_2, rtla 5.14.0-284.88.1.el9_2, bpftool 7.0.0-284.88.1.el9_2, kernel 5.14.0-284.88.1.el9_2, podman 4.4.1-13.rhaos4.13.el8, podman 4.4.1-14.rhaos4.13.el9, +88 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202410112148-0, openshift4/ose-cli v4.14.0-202410091239.p0.g44b3ac2.assembly.stream.el8, openshift4/ose-pod v4.14.0-202410091239.p0.g03a907c.assembly.stream.el8, openshift4/ose-tests v4.14.0-202410091239.p0.gc2c5a8e.assembly.stream.el8, openshift4/ose-console v4.14.0-202410162010.p0.g995c4dc.assembly.stream.el8, openshift4/ose-coredns v4.14.0-202410091239.p0.gfdd6037.assembly.stream.el8, +193 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202410020020-0, openshift4/ose-tests v4.15.0-202410020006.p0.g7db90dc.assembly.stream.el8, openshift4/ose-console v4.15.0-202410022035.p0.gf8ac02d.assembly.stream.el8, openshift4/ose-pod-rhel9 v4.15.0-202410010035.p0.g2ca1a23.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.15.0-202410010035.p0.gf371b5b.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.15.0-202410010035.p0.ga7005ef.assembly.stream.el9, +129 more
    +1 more products
    Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202409191851-0, openshift4/ose-cli-rhel9 v4.16.0-202409202304.p0.gc44c839.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202409202304.p0.gf10c92d.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.16.0-202409202304.p0.g807fca2.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.16.0-202409202304.p0.g16202ec.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202409240834.p0.g06403d4.assembly.stream.el9, +185 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.