-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis focused on the commit 10590b36f541130f6a5d7a49da0f095ff8390cce, which directly addresses the vulnerability. The core of the vulnerability was the lack of path validation in the validate_href method of the FileImageService class when handling file:// image URLs. This method is responsible for processing the image URL provided by the user. The patch introduced new validation logic (blocklist and allowlist for paths) within this function. The ironic.conf.types.ExplicitAbsolutePath.__call__ method was added to ensure the configured allowlist paths are secure, but the primary vulnerable function that processed the malicious input was validate_href.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ironic | pip | < 24.1.3 | 24.1.3 |
| ironic | pip | >= 25.0.0, < 26.1.1 | 26.1.1 |
| ironic | pip | >= 27.0.0, < 29.0.1 | 29.0.1 |
A Semantic Attack on Google Gemini - Read the Latest Research