{"cve":"CVE-2019-10141","nvd":{"published":"2019-07-30T17:15:12.453","modified":"2026-06-17T02:10:20.500","status":"Modified","description":"A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-89"],"references":["https://access.redhat.com/errata/RHSA-2019:2505","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141","https://docs.openstack.org/releasenotes/ironic-inspector/ocata.html#relnotes-5-0-2-7-origin-stable-ocata","https://docs.openstack.org/releasenotes/ironic-inspector/pike.html#relnotes-6-0-3-4-stable-pike","https://docs.openstack.org/releasenotes/ironic-inspector/queens.html#relnotes-7-2-4-stable-queens"],"products":["openstack:ironic-inspector","redhat:openstack"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-10141","score":0.02484,"percentile":0.84604,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-c7fc-cm7p-92r2","url":"https://osv.dev/vulnerability/GHSA-c7fc-cm7p-92r2","summary":"Openstack ironic-inspector has SQL injection vulnerability in node_cache","modified":"2024-09-27T16:01:01.223023Z","packages":[{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":["<5.0.2"],"fixed":["5.0.2"]},{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":[">=5.1.0 <6.0.3"],"fixed":["6.0.3"]},{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":[">=6.1.0 <7.2.4"],"fixed":["7.2.4"]},{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":[">=8.0.0 <8.0.3"],"fixed":["8.0.3"]},{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":[">=8.1.0 <8.2.1"],"fixed":["8.2.1"]}]},{"id":"PYSEC-2019-152","url":"https://osv.dev/vulnerability/PYSEC-2019-152","summary":"","modified":"2026-06-10T17:01:52.618778043Z","packages":[{"ecosystem":"PyPI","name":"ironic-inspector","purl":"pkg:pypi/ironic-inspector","ranges":[">=6.1.0 <7.2.4",">=8.1.0 <8.2.1","<5.0.2",">=5.1.0 <6.0.3",">=8.0.0 <8.0.3"],"fixed":["7.2.4","8.2.1","5.0.2","6.0.3","8.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}