Open Stack

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================
OpenStack Ironic does not honor clean steps
===========================================

:Date: December 03, 2015
:CVE: CVE-2015-7514


Affects
~~~~~~~
- - Ironic: >= 4.2.0, <= 4.2.1


Description
~~~~~~~~~~~
Brad Morgan from Rackspace reported a vulnerability in Ironic. To
prevent user data leak, Ironic is expected to "clean" a server after
use, however that is transparently not happening. Previous tenant's data
may be left behind on the disk and may be available to new users. All
Ironic setups are affected.

Patches
~~~~~~~
- - https://review.openstack.org/#/c/253001 (Liberty)
- - https://review.openstack.org/#/c/252993 (Mitaka)


Credits
~~~~~~~
- - Brad Morgan from Rackspace (CVE-2015-7514)


References
~~~~~~~~~~
- - https://bugs.launchpad.net/bugs/1517277
- - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7514


Notes
~~~~~
- - This fix will be included in a future 4.2.2 release.
- - This fix will be included in a future 4.3 release.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlZgbToACgkQhFvuBniJg6cL0QCgkLhJ2H3UNPWY3zW13vdCMcNV
BKQAoOYn0EUnrwTBegJvG5GVLU9y38lw
=3C97
-----END PGP SIGNATURE-----