CVE-2023-40585

Name of the Vulnerable Software and Affected Versions ironic-image versions prior to capm3-v1.4.3

Description The issue arises when Ironic is not deployed with TLS and does not have API and Conductor split into separate services, resulting in unprotected access to the API. By default, Ironic API in Metal3 is protected by TLS and basic authentication. However, if the operator configures the API without TLS, it becomes vulnerable. The API is also listening on the host network, which could allow access by anyone via the network without authentication if the node is not behind a firewall.

Recommendations For versions prior to capm3-v1.4.3, either configure TLS for Ironic API by running deploy.sh -t ... or setting IRONIC TLS SETUP=true, or split Ironic API and Conductor via configuration change. With both workarounds, services are configured with an httpd front-end, which has proper authentication configuration in place. For versions capm3-v1.4.3 and newer, no action is required as a patch exists in these versions.