| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-025: Ironic send_raw (CVE-2026-54423) https://review.opendev.org/c/openstack/ossa/+/996481 | 14:04 |
|---|---|---|
| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-026: Ironic rehoming (CVE-2026-44918) https://review.opendev.org/c/openstack/ossa/+/996482 | 14:09 |
| JayF | gouthamr: fungi: ^ Not super urgent as we'll have to wait for the gate to settle | 14:10 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-025: Ironic send_raw (CVE-2026-54423) https://review.opendev.org/c/openstack/ossa/+/996481 | 14:10 |
| JayF | gouthamr: fungi: I will self-merge -025 after double-checking the patch URLs in the rendered version | 14:21 |
| JayF | please say something if you are reviewing | 14:21 |
| fungi | i can review, i just needed to get ovh gra1 disabled now that my internet has come back | 14:22 |
| fungi | otherwise there was a good chance it wouldn't merge | 14:22 |
| fungi | looking at 996481 now | 14:22 |
| JayF | looks like I malformed the bug urls | 14:23 |
| fungi | ah yes | 14:23 |
| JayF | oh, I should open the bugs too, huh | 14:24 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-025: Ironic send_raw (CVE-2026-54423) https://review.opendev.org/c/openstack/ossa/+/996481 | 14:24 |
| JayF | -025 passes my review now, and that bug is open | 14:26 |
| JayF | going to review -026 and then touch that bug | 14:26 |
| fungi | another nice-to-have coding task for an intern would be adding a per-deliverable cross-cycle view to releases.openstack.org | 14:29 |
| fungi | would make it a lot easier to check the affected versions | 14:29 |
| JayF | -026 LGTM too, and those bugs are open | 14:29 |
| JayF | fungi: please merge them or lmk if I need to revise. I do not think it's worth it to churn the patch for whitespace (sorry Julia!) | 14:29 |
| fungi | will do, just about done checking the version numbers | 14:30 |
| JayF | I didn't re-review those; I just checked to make sure we didn't do a release. | 14:30 |
| JayF | Doing that slog once per patch is enough | 14:30 |
| fungi | approved OSSA-2026-025 | 14:31 |
| fungi | looking at the other one now | 14:31 |
| fungi | JayF: i'm still double-checking the urls but see my comment about the description rendering | 14:34 |
| fungi | it can also be fixed later in a non-errata followup if you think it's warranted | 14:35 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-026: Ironic rehoming (CVE-2026-44918) https://review.opendev.org/c/openstack/ossa/+/996482 | 14:36 |
| JayF | fixed | 14:36 |
| fungi | JayF: does OSSA-2026-026 really not affect some recent releases of ironic? the patches linked for those branches haven't merged yet | 14:39 |
| JayF | fungi: today is the embargo lift? Those patches didn't get uploaded until ~1 hour ago? | 14:40 |
| JayF | OH | 14:40 |
| fungi | talking about the affected versions list | 14:40 |
| JayF | fungi: I think that draft OSSA might have sat around past a release, I just need to bump the patch release versions across? | 14:40 |
| fungi | yes seems like it | 14:40 |
| fungi | for example is says 32.0.1 is unaffected | 14:41 |
| JayF | yeah I know what happened, I'll take a pass there | 14:41 |
| JayF | fungi: version: '>=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0' | 14:43 |
| JayF | fungi: quick review on that without churning CI? | 14:43 |
| * JayF adds a <37.0.1 to the end | 14:44 | |
| opendevreview | Merged openstack/ossa master: OSSA-2026-025: Ironic send_raw (CVE-2026-54423) https://review.opendev.org/c/openstack/ossa/+/996481 | 14:45 |
| fungi | JayF: lgtm, matches the other ironic ossa i just proofed | 14:45 |
| JayF | well copying that would've been smart of me, eh | 14:45 |
| JayF | lol | 14:45 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: OSSA-2026-026: Ironic rehoming (CVE-2026-44918) https://review.opendev.org/c/openstack/ossa/+/996482 | 14:46 |
| fungi | i'm surprised i'm even thinking this straight, came home from the mountains to find the air conditioning was out, and the hvac contractor can't seem to figure out the problem yet, so after an all-day drive i've spent two nights straight trying to sleep in humid 85f temperatures so far | 14:47 |
| JayF | OSSA-2026-025 is announced | 14:48 |
| JayF | fungi: portable AC units are not a horrible thing to have as a backup. Also car A/C can help. We lost ours for two days during a historic 100F+ hot pair of days some years back | 14:49 |
| fungi | yeah, there's a heat wave here so every portable/window ac is sold out for miles in all directions. i'd get a hotel room but it's the height of tourist season so no vacancies | 14:50 |
| fungi | at least we were able to just leave the cats boarded for a couple more days while we sort things out | 14:50 |
| JayF | fungi: I'm somewhat serious: I can call my folks and see if they have one in the garage. They are like an hour from you iirc | 14:51 |
| fungi | tempting, but thankfully today's not as hot as yesterday. also i'll be outside a good chunk of the afternoon catching up on lingering yardwork | 14:52 |
| fungi | i approved the other ossa | 14:53 |
| JayF | I just self-approved my announce for -025 | 14:53 |
| JayF | I'll announce -026 once it lands | 14:53 |
| fungi | oh, thanks i meant to be watching the announce moderation queue | 14:53 |
| JayF | any way we can get https://zuul.opendev.org/t/openstack/status?change=996482 to the top of the queue | 15:02 |
| JayF | idk if you did it or not, but it's running | 15:05 |
| fungi | it already is at the top of the queue | 15:05 |
| fungi | openstack/ossa doesn't share a dependent change queue in the gate pipeline with any other projects | 15:05 |
| fungi | items in the gate pipeline also get priority on their node requests over items in the check pipeline | 15:06 |
| fungi | reordering changes in a queue is only beneficial if you want some change to merge before other changes in the same queue anyway, in this case it's a queue of one | 15:06 |
| opendevreview | Merged openstack/ossa master: OSSA-2026-026: Ironic rehoming (CVE-2026-44918) https://review.opendev.org/c/openstack/ossa/+/996482 | 15:07 |
| fungi | there are also other factors that weight the prioritization though, like how many jobs have been run for the same project recently | 15:07 |
| fungi | so that projects running a lot of jobs for a lot of changes won't starve out projects that run comparatively few jobs for few changes | 15:08 |
| fungi | part of what zuul terms its "fair queuing algorithm" | 15:08 |
| JayF | OSSA-2026-026 announced | 15:09 |
| JayF | crap, I missed the (CVE-xxxx) on the end | 15:09 |
| JayF | going to reject my announce but I can't fix the oss-security one | 15:09 |
| fungi | yeah, i see it in the announce pipeline | 15:10 |
| fungi | don't sweat the ones that already went out, the message bodies mention the cve multiple times anyway | 15:10 |
| fungi | having it in the subject is merely convenience | 15:10 |
| fungi | accepted the new version in the moderation queue | 15:12 |
| JayF | I can't find how to mark a CVE as public/released in the new mitre form? | 15:17 |
| fungi | i haven't done it yet myself... gouthamr ^ ? | 15:18 |
| gouthamr | yes, update the CAN | 15:18 |
| gouthamr | set the field: "Should the vulnerability be published on the CVE List now?" to yes | 15:19 |
| JayF | so what you're saying is | 15:19 |
| JayF | I should've saved the CAN- number | 15:19 |
| gouthamr | and add a comment under "New Communication to CNA-LR" | 15:19 |
| gouthamr | haha, yes :D | 15:19 |
| gouthamr | but, you'll find it under "Portal" | 15:19 |
| JayF | this new system is awful | 15:19 |
| JayF | yeah those don't have CVE- or OSSA- on them | 15:19 |
| JayF | not enough metadata to map to tickets | 15:19 |
| gouthamr | YES, i hate that part | 15:20 |
| JayF | I mean, hate that part or not hate that part, I do not have the info to do this | 15:20 |
| JayF | what a flawed system :( | 15:20 |
| gouthamr | i literally Ctrl-F the CAN-ID i commented on the LP to track it | 15:20 |
| JayF | Yeah, same, except for that part where I didn't put the CAN-ID for this one on there | 15:20 |
| JayF | it's a chance I got this CVE through the old form, tbh | 15:20 |
| fungi | if i were cynical i'd suspect it's a passive-aggressive way of encouraging people to request cve assignments elsewhere or apply to become a cna themselves | 15:20 |
| JayF | I am cynical, and I suggest that. | 15:21 |
| JayF | lol | 15:21 |
| JayF | I am using their "report a public-but-reserved CVE" form, with something in the comment section describing my inability to map CAN- to CVE- for that bug | 15:24 |
| gouthamr | ack, hope that works.. do you have too many CANs? | 15:25 |
| JayF | I will wait to submit until -026 appears on the web | 15:25 |
| JayF | I have like 7 CANs in here right now | 15:25 |
| JayF | and am NOT going to play process of elimination so I can intellegently guess which one | 15:25 |
| JayF | which might be wrong | 15:25 |
| JayF | this is not a place for guessing. if it's extra work for them to use that form, then maybe their website shouldn't look like the finest in enterprise software from 1996 | 15:26 |
| gouthamr | :P wasn't luring you to divulge the number.. but, i have had to open each of mine to verify stuff in the past few weeks.. sucks, /me shakes fist at MITRE | 15:26 |
| * JayF kicks the AFS server | 15:27 | |
| JayF | I don't have any access, I'm only kicking it in my heart :D | 15:27 |
| JayF | lol | 15:27 |
| JayF | https://security.openstack.org/ossa/OSSA-2026-026.html still 404'ing a good hour after merge? | 15:27 |
| JayF | fungi: ^ | 15:27 |
| * gouthamr imitates south park, don't kick the AFS | 15:27 | |
| fungi | lookin | 15:27 |
| fungi | looks like someone uploaded something large to the tarballs volume shortly before 15:00 utc so that's been syncing to the remote read-only volumes for a while | 15:29 |
| fungi | i'll manually force a release of the security site volume in the meantime | 15:29 |
| fungi | oh, wait, it just woke up on its own | 15:30 |
| fungi | it's updated now | 15:31 |
| JayF | I think I told MITRE to release both CVEs now, too | 15:33 |
| fungi | JayF: following the comments on OSSA-2026-026 are we likely to have errata patches added for that? | 17:47 |
| fungi | just making sure i keep an eye out so i can expedite reviewing if so | 17:48 |
| JayF | I'm pretty sure it's just a patch-is-not-right-in-all-cases issue | 17:50 |
| fungi | okay | 17:50 |
| JayF | we never merged a broken patch | 17:50 |
| JayF | so URLs will still work and things will get merged once Julia finds the fix | 17:51 |
| fungi | makes sense, hard to tell from the discussion in the bug alone | 17:51 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!