| *** mrunge_ is now known as mrunge | 00:00 | |
| Viii | https://www.cve.org/CVERecord?id=CVE-2026-99999 | 07:05 |
|---|---|---|
| *** mikal3 is now known as mikal | 07:08 | |
| fungi | Viii: was that observed as a source of disruption in an openstack cloud? | 12:41 |
| gouthamr | https://bugs.launchpad.net/manila/+bug/2161412 is now public | 14:04 |
| gouthamr | https://bugs.launchpad.net/manila/+bug/2168962 is now public | 14:06 |
| carloss | ++ | 14:07 |
| rosmaita | https://bugs.launchpad.net/cinder/+bug/2160671 is public | 14:11 |
| opendevreview | Brian Rosmaita proposed openstack/ossa master: Add OSSA-2026-045 (CVE-2026-93856) https://review.opendev.org/c/openstack/ossa/+/1011492 | 14:19 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-046 (CVE-2026-71195) https://review.opendev.org/c/openstack/ossa/+/1011493 | 14:24 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-046 (CVE-2026-71195) https://review.opendev.org/c/openstack/ossa/+/1011493 | 14:24 |
| gouthamr | rosmaita: can you help land this: https://review.opendev.org/c/openstack/ossa/+/1007325 | 14:42 |
| gouthamr | it'll make both the OSSAs render the "Independent" reporter correctly | 14:42 |
| gouthamr | righ now it says: "Yuliang Xiao from Independent" | 14:42 |
| gouthamr | https://de3c109f548194542df7-51174786df661fdc707186ccf04b5df9.ssl.cf1.rackcdn.com/openstack/9c92d62b409c40e8b84fe813b7d1359e/docs/ossa/OSSA-2026-045.html | 14:43 |
| gouthamr | there are organizations out there called "Independent" | 14:43 |
| fungi | i also left a similar comment on the review, reminding that it's possible to just omit the affiliation if there is none | 14:43 |
| fungi | the field is optional | 14:44 |
| gouthamr | ++ that'd work | 14:44 |
| fungi | 1007325 and the other existing carve-outs are merely there so that we don't have to go back through historical advisories and clean those up | 14:45 |
| JayF | gouthamr: flight 1007325 cleared for landing, runway ossa | 14:51 |
| gouthamr | \o/ | 14:51 |
| opendevreview | Merged openstack/ossa master: Skip 'from' for unknown/independent affiliations https://review.opendev.org/c/openstack/ossa/+/1007325 | 15:00 |
| gouthamr | carloss: dviroel: would appreciate a review on this OSSA: https://review.opendev.org/c/openstack/ossa/+/1011493 | 15:02 |
| gouthamr | rosmaita: eharney: was there anyone that was still reviewing https://review.opendev.org/c/openstack/ossa/+/1011492 ? | 15:03 |
| rosmaita | gouthamr: i was just making those changes you pointed out | 15:09 |
| opendevreview | Brian Rosmaita proposed openstack/ossa master: Add OSSA-2026-045 (CVE-2026-93856) https://review.opendev.org/c/openstack/ossa/+/1011492 | 15:17 |
| fungi | we had also discussed leaving out the "reported" section in unambiguous cases (only one cve and/or only one reporter) | 15:21 |
| fungi | but doesn't hurt to include it | 15:21 |
| gouthamr | ++ workflowed OSSA-2026-045 | 15:24 |
| rosmaita | thanks! | 15:27 |
| fungi | it's in the gate now | 15:27 |
| dviroel | 046 lgtm | 15:28 |
| carloss | 046 lgtm too | 15:29 |
| carloss | thank you, gouthamr | 15:29 |
| gouthamr | ty; it was more prose than we usually do.. but its also a couple of bugs that snowballed. sorry about the text wrapping; i'll take an L for that | 15:34 |
| gouthamr | ty for fixing it up, carloss and for reviewing dviroel | 15:34 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-045 (CVE-2026-93856) https://review.opendev.org/c/openstack/ossa/+/1011492 | 15:38 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-046 (CVE-2026-71195) https://review.opendev.org/c/openstack/ossa/+/1011493 | 16:05 |
| fungi | i'm on hand to accept posts to openstack-announce | 16:14 |
| gouthamr | ++ prepping now | 16:17 |
| fungi | rosmaita: ^ | 16:17 |
| rosmaita | ack, will send momentarily | 16:18 |
| rosmaita | fungi: sent | 16:22 |
| rosmaita | shoot, forgot to gpg sign | 16:22 |
| fungi | i discarded it | 16:22 |
| fungi | resend signed | 16:22 |
| rosmaita | resent | 16:24 |
| fungi | accepted | 16:25 |
| rosmaita | ty | 16:25 |
| fungi | of course | 16:25 |
| * gouthamr waits said 5 minutes :P | 16:25 | |
| fungi | accepted 046 in o-a | 16:31 |
| gouthamr | ty fungi | 16:34 |
| fungi | https://bugs.launchpad.net/octavia/+bug/2171385 is now public | 16:44 |
| fungi | tonyb: dmendiza[m]: are either of you interested in getting involved in vulnerabiltiy management soon? if not, i want to go ahead and prune the vmt membership to currently active participants for safety reasons | 18:13 |
| * gouthamr informed MITRE to publish CVE-2026-71195 | 18:24 | |
| fungi | https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 seems to have the most detailed background on the emerging emudhra ca key compromise incident that's unfolding ~everywhere all at once | 19:26 |
| fungi | for openstack development impact, new versions of certifi and pip just got published | 19:27 |
| gouthamr | https://bugs.launchpad.net/neutron/+bug/2161501 is now public | 19:28 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!