Skip to content
Fencer Intel
high 7.5

CVE-2016-4985 json

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

published 2016-07-12 10 y ago modified 2026-07-06 4 mo ago also GHSA-f7cr-7c2c-fm8r , PYSEC-2026-646 , EUVD-2022-3715

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.

Patch / fix

  • pypi ironic 4.2.5, 5.1.2
  • ironic Debian 14, Debian 13, Debian 12 1:5.1.2-1

debian advisories DEBIAN-CVE-2016-4985

  • ironic Ubuntu 16.04 LTS 1:5.1.2-0ubuntu1

ubuntu advisories UBUNTU-CVE-2016-4985

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openstack-ironic openstack 8 1:4.2.5-1.el7ost
  • openstack-ironic-api openstack 8 1:4.2.5-1.el7ost
  • openstack-ironic-common openstack 8 1:4.2.5-1.el7ost
  • openstack-ironic-conductor openstack 8 1:4.2.5-1.el7ost
  • openstack-ironic openstack 7 2015.1.2-4.el7ost
  • openstack-ironic-api openstack 7 2015.1.2-4.el7ost
  • openstack-ironic-common openstack 7 2015.1.2-4.el7ost
  • openstack-ironic-conductor openstack 7 2015.1.2-4.el7ost

red hat advisories RHSA-2016:1378RHSA-2016:1377

  • openstack-trove OpenStack Cloud 6 4.0.1~a0~dev19-8.1
  • openstack-ironic OpenStack Cloud 6 4.2.5-6.1
  • openstack-sahara OpenStack Cloud 6 3.0.3~a0~dev1-6.1
  • openstack-tempest OpenStack Cloud 6 7.0.0-9.1
  • openstack-designate OpenStack Cloud 6 1.0.3~a0~dev10-6.1
  • openstack-nova-docker OpenStack Cloud 6 0.0.1~a0~dev238-4.1
  • openstack-neutron-vpnaas OpenStack Cloud 6 7.0.5~a0~dev3-6.1

suse advisories SUSE-SU-2016:1966-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-4985 updated cvss 5.9

openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users

  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno) openstack-ironic
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-ironic 2015.1.2-4.el7ost, openstack-ironic-api 2015.1.2-4.el7ost, openstack-ironic-common 2015.1.2-4.el7ost, openstack-ironic-conductor 2015.1.2-4.el7ost
    fixed: vendor fix RHSA-2016:1377
  • Red Hat OpenStack Platform 8.0 (Liberty) openstack-ironic 4.2.5-1.el7ost, openstack-ironic-api 4.2.5-1.el7ost, openstack-ironic-common 4.2.5-1.el7ost, openstack-ironic-conductor 4.2.5-1.el7ost
    fixed: vendor fix RHSA-2016:1378
  • Red Hat OpenStack Platform 9 (Mitaka) python-ironic-tests, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor Red Hat OpenStack Platform 10 (Newton) python-ironic-tests, openstack-ironic-api, openstack-ironic-common, openstack-ironic-conductor
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.86% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi ironic
<4.2.5
>=5.0, <5.1.2
4.2.5
5.1.2

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.