| opendevreview | Tobias Urdin proposed openstack/security-doc master: OSSN-0112: Add security note for Gnocchi GHSA-cjq3-6hm7-q33w https://review.opendev.org/c/openstack/security-doc/+/1007657 | 07:13 |
|---|---|---|
| tobias-urdin | hello o/ i've asked for a new OSSN above^ for an advisory that was released just now, would appreciate if you could review it – let me know if you want the number to number to change I based it on open patches and not merged | 07:16 |
| opendevreview | Tobias Urdin proposed openstack/security-doc master: OSSN-0112: Add security note for Gnocchi GHSA-cjq3-6hm7-q33w https://review.opendev.org/c/openstack/security-doc/+/1007657 | 09:03 |
| opendevreview | Tobias Urdin proposed openstack/security-doc master: OSSN-0112: Add security note for Gnocchi GHSA-cjq3-6hm7-q33w https://review.opendev.org/c/openstack/security-doc/+/1007657 | 09:04 |
| opendevreview | Grzegorz Grasza proposed openstack/security-doc master: Add OSSN-0113: project-scoped admin remains cloud-wide https://review.opendev.org/c/openstack/security-doc/+/1007719 | 13:56 |
| opendevreview | Tobias Urdin proposed openstack/security-doc master: OSSN-0112: Add security note for Gnocchi GHSA-cjq3-6hm7-q33w https://review.opendev.org/c/openstack/security-doc/+/1007657 | 15:00 |
| fungi | we have 5 pending ossn articles in review, the earliest one (proposed as 0109) has a -1 from acabistani that i think xek has answered, the next oldest (proposed as 0110) has a +2 from d34dh0r53... i'm not sure if we counted ossn in our release week notifications/announcements blackout, but expect we are | 15:03 |
| gouthamr | we only counted the ones we've merged | 16:52 |
| gouthamr | i'll also take a look at this backlog.. | 16:53 |
| gouthamr | zigo told me about.. bringing this here | 17:28 |
| gouthamr | https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51772.md | 17:28 |
| gouthamr | https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51773.md | 17:28 |
| gouthamr | zigo: neither of these issues were reported to the VMT. The assigner is MITRE (Red Hat published https://access.redhat.com/security/cve/cve-2026-51773 - their judgement about it not affecting their product) | 17:28 |
| fungi | neat | 17:28 |
| gouthamr | i'm not familiar with https://github.com/sadandbset ; they didn't follow our processes afaict.. the CVE assignments were requested on 2026-06-08 and disclosed on 2026-09-25 | 17:29 |
| fungi | i wonder if any glance maintainers were contacted about it directly | 17:30 |
| gouthamr | croeland1: ^ maybe? | 17:30 |
| gouthamr | hey fungi abhishekk told me that https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51772.md corresponds to https://bugs.launchpad.net/glance/+bug/2161330 (OSSA-2026-038) | 18:07 |
| gouthamr | what do we do with this weirdness? | 18:07 |
| gouthamr | https://bugs.launchpad.net/glance/+bug/2167929 is now public | 18:08 |
| gouthamr | ^ it corresponds to https://github.com/sadandbset/CVE-2026-51772-CVE-2026-51773/blob/main/CVE-2026-51773.md | 18:08 |
| gouthamr | weirdness: we have a duplicate CVE, should _we_ care? | 18:08 |
| fungi | the wierdness being two different cve ids? | 18:09 |
| fungi | if someone cares, they should ask the cna to "reject" the extra cve id | 18:09 |
| gouthamr | ack, in this case, whoever cares must inform MITRE that the vulnerability was assigned CVE-2026-71198 and that they should reject CVE-2026-51772? | 18:10 |
| gouthamr | #TIL about this rejection process | 18:11 |
| fungi | i would say because we weren't notified about the cve id assigned by red hat's cna, and the project officially requested a cve id from mitre which it included in its public communications/advisory, red hat's cna needs to be informed that their assignment is a duplicate | 18:13 |
| gouthamr | it wasn't Red Hat though | 18:14 |
| gouthamr | both were assigned by MITRE | 18:14 |
| fungi | oh, i thought someone said it came from the red hat cna | 18:14 |
| fungi | anyway basically whichever id the vulnerability is most widely known by is the one to keep, request the assigning cna of the other one to reject it as a duplicate | 18:14 |
| gouthamr | nope, Red Hat has scored CVE-2026-51773 and declared themselves unaffected.. but doesn't have a record of CVE-2026-51772.. both of these were assigned by MITRE (going by their record on cve.org) | 18:15 |
| fungi | aha, that explains my confusion. sorry! | 18:17 |
| -opendevstatus- NOTICE: Zuul is reporting inconsistent results showing failures in Gerrit comments and in progress status in the Zuul UI. This is due to Zuul database issues that we are working to correct. | 19:04 | |
| gouthamr | i can haz +2 for https://review.opendev.org/c/openstack/ossa/+/998262 when you have a few fungi rosmaita? | 20:55 |
| gouthamr | and this teeny patch too: https://review.opendev.org/c/openstack/ossa/+/1000056 | 20:55 |
| fungi | looking | 21:03 |
| *** mrunge_ is now known as mrunge | 23:52 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!