| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-041 (CVE-2026-pending) https://review.opendev.org/c/openstack/ossa/+/1007052 | 05:23 |
|---|---|---|
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-041 (CVE-2026-97149) https://review.opendev.org/c/openstack/ossa/+/1007052 | 06:11 |
| opendevreview | Grzegorz Grasza proposed openstack/security-doc master: Add OSSN-0111: Keystone MFA enforcement gaps and replay weaknesses https://review.opendev.org/c/openstack/security-doc/+/1006742 | 09:54 |
| opendevreview | Grzegorz Grasza proposed openstack/security-doc master: Add OSSN-0111: Keystone MFA enforcement gaps and replay weaknesses https://review.opendev.org/c/openstack/security-doc/+/1006742 | 10:17 |
| opendevreview | Grzegorz Grasza proposed openstack/security-doc master: Add OSSN-0111: Keystone MFA enforcement gaps and replay weaknesses https://review.opendev.org/c/openstack/security-doc/+/1006742 | 10:48 |
| tkajinam | gouthamr, lmk when we can start the process. | 14:04 |
| fungi | tkajinam: https://bugs.launchpad.net/zaqar/+bug/2164987 is now public | 14:12 |
| fungi | i think gouthamr may not be around yet but we can proceed | 14:12 |
| tkajinam | fungi, thx ! | 14:12 |
| fungi | yw | 14:12 |
| * tkajinam pushed the fixes to gerrit | 14:14 | |
| tkajinam | fingers crossed | 14:14 |
| gouthamr | ty fungi tkajinam | 14:17 |
| fungi | i also gave the release team a heads up that we'll have new stable/2026.2 requests posted for swift and zaqar today, but will then observe a publication blackout until the week of october 5 in order to not destabilize the coordinated release process | 14:18 |
| gouthamr | ack, ty | 14:18 |
| fungi | on a related note, the tacker rc2 request is up now that fixes have merged for two public security bugs we haven't published an advisory for yet: https://bugs.launchpad.net/tacker/+bug/2154537 and https://bugs.launchpad.net/tacker/+bug/2154540 | 14:30 |
| fungi | i've added comments to both bugs to that effect, since there was no indication in either of them that fixes had been proposed for review yet | 14:42 |
| fungi | with the publication of today's advisories, we will have published more so far this year than in any prior year of the project's history (the previous record was 41 advisories in 2014) | 14:47 |
| gouthamr | ah, they used the URL in Closes-Bug | 14:49 |
| gouthamr | iirc someone tried to fix gerrit's logic to accommodate a URL for this sorta link text | 14:49 |
| fungi | that may also confuse our release automation that comments on bugs when fixes appear in new tags | 14:49 |
| gouthamr | true | 14:50 |
| fungi | we'll find out shortly when https://review.opendev.org/c/openstack/releases/+/1007234 merges | 14:52 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-042 (CVE-2026-pending) https://review.opendev.org/c/openstack/ossa/+/1007254 | 15:04 |
| fungi | i've asked timburke in #openstack-swift if he wants me to approve the pending stable/2026.2 backport | 15:12 |
| fungi | so that we'll be able to get the release request up today, since this is the deadline to be included in wednesday's coordinated release | 15:12 |
| fungi | gouthamr: i've very closely inspected both proposed ossas and approved them now so we can keep publication on track | 15:21 |
| fungi | if details of an advisory need correcting/clarification later i think we can exempt errata for them from our publication hiatus, as long as that doesn't involve addition of new unreleased patches | 15:25 |
| JayF | fungi: we aren't *quite* there if you add OSSN + OSSA from 2014 | 15:25 |
| JayF | fungi: but are still on track | 15:26 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-041 (CVE-2026-97149) https://review.opendev.org/c/openstack/ossa/+/1007052 | 15:26 |
| fungi | yeah, i was only counting ossa, the ossn dump that year was another matter entirely | 15:26 |
| gouthamr | woah, timing | 15:29 |
| gouthamr | got a CVE assignment for the zaqar bug | 15:29 |
| gouthamr | crap :P won't race it to the gate | 15:29 |
| gouthamr | or maybe i will? | 15:30 |
| fungi | push it | 15:31 |
| fungi | i unapproved | 15:32 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-042 (CVE-2026-97404) https://review.opendev.org/c/openstack/ossa/+/1007254 | 15:32 |
| fungi | gouthamr: do you want to include the reported reference with the reporter too? | 15:33 |
| fungi | on an unrelated note, the release job to update the tacker bugs fixed in rc2 did actually find the bug numbers, so it's just the update-bug script in jeepyb that needs to be able to parse bug urls i guess | 15:38 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-042 (CVE-2026-97404) https://review.opendev.org/c/openstack/ossa/+/1007254 | 15:40 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-042 (CVE-2026-97404) https://review.opendev.org/c/openstack/ossa/+/1007254 | 15:43 |
| gouthamr | ugh, didn't mean to do that | 15:44 |
| gouthamr | sorry, fungi .. | 15:44 |
| fungi | no worries | 15:45 |
| fungi | https://bugs.launchpad.net/keystone/+bug/2166689 is now public | 15:53 |
| gouthamr | fungi: emails (finally) sent for 041/042 and :) | 16:23 |
| gouthamr | how do we handle tacker? they need backports landing in older stable releases too | 16:23 |
| fungi | gouthamr: right, no ossa for tacker yet until they backport more | 16:26 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-042 (CVE-2026-97404) https://review.opendev.org/c/openstack/ossa/+/1007254 | 16:26 |
| fungi | openstack-announce posts accepted now | 16:26 |
| gouthamr | ty | 16:30 |
| tkajinam | the security fix for zaqar was merged to master and 2026.2 . I'll take care of further backports but for the time being we can move rc2 release ahead which may be urgent due to ga coming quite soon. | 18:07 |
| fungi | yep, thanks tkajinam! i think we just need zaqar's ptl or release liaison to +1 it but i already +2'd for the release team | 18:17 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Skip 'from' for unknown/independent affiliations in new advisories https://review.opendev.org/c/openstack/ossa/+/1007325 | 21:29 |
| fungi | https://blog.arusekk.pl/posts/srht-account-takeover/ is a great read | 22:06 |
| fungi | the dig at projects not packaging their software is great, but i especially appreciated the callout to how useless cvss is for upstreams | 22:06 |
| gouthamr | "it should be separate for each product and not just one for one root cause code path." - yes | 22:09 |
| gouthamr | wow, coincidentally, i was thinking of sorin's fix this morning to system-config or jeepyb to allow URLs in "Closes-Bug" and other footer text | 22:11 |
| fungi | i couldn't find that fix, fwiw | 22:13 |
| gouthamr | i thnk it never made it | 22:14 |
| gouthamr | lemme try :P | 22:14 |
| gouthamr | https://review.opendev.org/c/opendev/system-config/+/737960 | 22:15 |
| gouthamr | small world | 22:16 |
| fungi | oh in system-config not jeepyb | 22:20 |
| fungi | and abandoned, so wouldn't have turned up in my searching | 22:21 |
| gouthamr | good note on https://review.opendev.org/c/openstack/ossa/+/1007325 - i agree with you that this complexity isn't warranted. It changes a handful of advisories and formats them like we want (drop the bogus affiliation or empty parantheses) | 22:24 |
| gouthamr | https://bugs.launchpad.net/manila/+bug/2163229 is now public | 22:25 |
| JayF | 10000% | 22:27 |
| JayF | if someone is consuming the *HTML* instead of the *YAML* programatically | 22:27 |
| JayF | that'd be silly :D | 22:27 |
| gouthamr | :P i was overthinking | 22:27 |
| JayF | we all get stable-brained working in openstack | 22:29 |
| JayF | not always bad lol | 22:29 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Skip 'from' for unknown/independent affiliations https://review.opendev.org/c/openstack/ossa/+/1007325 | 22:31 |
| *** mrunge_ is now known as mrunge | 23:55 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!