Read the docs
TI-2016-04306 Aliases CVE-2016-4985GHSA-f7cr-7c2c-fm8r

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2…

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Why it matters now

EPSS 0.0286 86th percentileScored 2026-11-07
Fix Partial ironic (PyPI): 4.2.5, 5.1.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ironic (PyPI)before 4.2.54.2.5Patch availableGHSA-f7cr-7c2c-fm8r
—ironic (PyPI)5.0 to before 5.1.25.1.2Patch availableGHSA-f7cr-7c2c-fm8r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ironic (PyPI) Vendor— Affected before 4.2.5 Fixed in 4.2.5 Patch available GHSA-f7cr-7c2c-fm8r
  • ironic (PyPI) Vendor— Affected 5.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-f7cr-7c2c-fm8r

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*8VulnerableRed Hat
cpe:2.3:a:canonical:openstack_ironic:*:*:*:*:*:*:*:*up to 4.2.4VulnerableCanonical
cpe:2.3:a:canonical:openstack_ironic:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableCanonical
cpe:2.3:a:canonical:openstack_ironic:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableCanonical
  • cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Red Hat
  • cpe:2.3:a:canonical:openstack_ironic:*:*:*:*:*:*:*:* Versions up to 4.2.4 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:openstack_ironic:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:openstack_ironic:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-f7cr-7c2c-fm8r ironic (PyPI) Fixed in 4.2.5 Advisory →
  • Fix · GHSA-f7cr-7c2c-fm8r ironic (PyPI) Fixed in 5.1.2 Advisory →

Red Hat 2 advisories

  • RHSA-2016:1377 Released 2016-07-04 · Red Hat rating Moderate
    openstack-ironic security update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-ironic-2015.1.2-4.el7ost, openstack-ironic-api-2015.1.2-4.el7ost, openstack-ironic-common-2015.1.2-4.el7ost +1
  • RHSA-2016:1378 Released 2016-07-04 · Red Hat rating Moderate
    openstack-ironic security update
    • Red Hat OpenStack Platform 8.0 (Liberty) openstack-ironic-1:4.2.5-1.el7ost, openstack-ironic-api-1:4.2.5-1.el7ost, openstack-ironic-common-1:4.2.5-1.el7ost +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2016:1377
Red Hat OpenStack Platform 8.0 (Liberty)Fixed RHSA-2016:1378
Not affected: 2 products
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 9 (Mitaka)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-4985
  2. 2026-10-03 Alias added: GHSA-f7cr-7c2c-fm8r

References

Advisory 4

Other 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences