Publish GHSA-f7cr-7c2c-fm8r

advisories/github-reviewed/2022/05/GHSA-f7cr-7c2c-fm8r/GHSA-f7cr-7c2c-fm8r.json

@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f7cr-7c2c-fm8r",
-  "modified": "2022-05-13T01:07:34Z",
+  "modified": "2024-05-14T17:31:21Z",
   "published": "2022-05-13T01:07:34Z",
   "aliases": [
     "CVE-2016-4985"
   ],
-  "details": "The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.",
+  "summary": "OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor",
+  "details": "The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the `v1/drivers/$DRIVER_NAME/vendor_passthru` resource.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,13 +15,62 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "ironic"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.2.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "ironic"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.0"
+            },
+            {
+              "fixed": "5.1.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4985"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2016:1377"
@@ -41,6 +91,10 @@
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1346193"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/openstack/ironic"
+    },
     {
       "type": "WEB",
       "url": "https://review.openstack.org/332195"
@@ -63,8 +117,8 @@
       "CWE-200"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-14T17:31:21Z",
     "nvd_published_at": "2016-07-12T19:59:00Z"
   }
 }