CVE-2019-10141

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-10141
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10141.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-10141
Aliases
Downstream
Published
2019-07-30T17:15:12.453Z
Modified
2026-07-08T05:53:38.584423132Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's nodecache.findnode(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10"
                },
                {
                    "last_affected": "10"
                },
                {
                    "introduced": "13"
                },
                {
                    "last_affected": "13"
                },
                {
                    "introduced": "14"
                },
                {
                    "last_affected": "14"
                },
                {
                    "introduced": "9"
                },
                {
                    "last_affected": "9"
                }
            ],
            "vendor_product": "redhat:openstack",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/openstack/ironic-inspector

Affected ranges

Type
GIT
Repo
https://github.com/openstack/ironic-inspector
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
53f44a7ccf8164d19031266a35e341cc557ee84a
Introduced
42963fa9f75313f253527baaeda39249a89fe185
Fixed
99c88629ad879e5c50c113f2fcd62f49a711ce3f
Introduced
04e646c6429b128039a572805178ac99113bee5e
Fixed
17c796b49171b6133e988f78c92d7c9b7ed3fcf3
Introduced
600784a91e21cc16ca1e1c34367af7f2327ad79c
Fixed
97f9d34f8376ac7accd2597b3bdce67a9dac664f
Introduced
8d41543c1b0ac88233a42c08ad5348d576d57962
Fixed
67ff87ebca1016d44bd9d284ec4c16a88a533cfc
Database specific 
{
    "cpe": "cpe:2.3:a:openstack:ironic-inspector:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.2"
        },
        {
            "introduced": "5.1.0"
        },
        {
            "fixed": "6.0.3"
        },
        {
            "introduced": "6.1.0"
        },
        {
            "fixed": "7.2.4"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.3"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.2.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
1.*
1.0.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.3.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
4.*
4.0.0
4.1.0
4.2.0
5.*
5.0.0
5.0.1
5.1.0
6.*
6.0.0
6.0.1
6.0.2
6.1.0
7.*
7.0.0
7.1.0
7.2.0
7.2.1
7.2.2
7.2.3
8.*
8.0.0
8.0.1
8.0.2
8.1.0
8.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10141.json"