CVE-2016-4985

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-12 · updated 2026-06-17
Weakness: CWE-200

Description

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Affected products

Canonical Openstack Ironic: through 4.2.4; 5.1.0, 5.1.1
OpenStack: 7.0, 8

References

http://www.openwall.com/lists/oss-security/2016/06/21/6
https://access.redhat.com/errata/RHSA-2016:1377
https://access.redhat.com/errata/RHSA-2016:1378
https://bugs.launchpad.net/ironic/+bug/1572796
https://review.openstack.org/332195
https://review.openstack.org/332196
https://review.openstack.org/332197
http://www.openwall.com/lists/oss-security/2016/06/21/6
https://access.redhat.com/errata/RHSA-2016:1377
https://access.redhat.com/errata/RHSA-2016:1378
https://bugs.launchpad.net/ironic/+bug/1572796
https://review.openstack.org/332195

Get alerted when CVE-2016-4985 or the next vulnerability affects your stack