In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3482 advisory.

    Ironic is a project which aims to provision bare metal (as opposed to     virtual) machines by leveraging common technologies such as PXE boot and     IPMI to cover a wide range of hardware, while supporting pluggable drivers     to allow vendor-specific functionality to be added.Bare Metal provisioning     for OpenStack

    Security Fix(es):

    * Lack of checksum validation on images (CVE-2024-47211)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and     26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured     to convert images to a raw format for streaming. (CVE-2024-47211)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and
    26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured
    to convert images to a raw format for streaming. (CVE-2024-47211)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0439 advisory.

    Ironic is a project which aims to provision bare metal (as opposed to     virtual) machines by leveraging common technologies such as PXE boot and     IPMI to cover a wide range of hardware, while supporting pluggable drivers     to allow vendor-specific functionality to be added.Bare Metal provisioning     for OpenStack

    Security Fix(es):

    * Lack of checksum validation on images (CVE-2024-47211)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
234264	RHEL 9 : Red Hat OpenStack Platform 17.1 (openstack-ironic) (RHSA-2025:3482)	Nessus	Red Hat Local Security Checks	Local	medium
229193	Linux Distros Unpatched Vulnerability : CVE-2024-47211	Nessus	Misc.	Local	medium
412677	SCA: security update for ironic (GHSA-8h22-6qwx-q4w9)	Tenable Cloud Security	SCA Checks	Local	medium
412677	SCA: security update for ironic (GHSA-8h22-6qwx-q4w9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
214503	RHEL 9 : Red Hat OpenStack Platform 18.0.4 (openstack-ironic) (RHSA-2025:0439)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-47211

medium

Tenable Plugins

medium

medium

medium

medium

medium