Thursday, 2026-10-22

« Wednesday, 2026-10-21 Index
opendevreviewAbhishek Kekane proposed openstack/security-doc master: Add OSSN-0115 for LUKS key logging  https://review.opendev.org/c/openstack/security-doc/+/101166806:12
opendevreviewAbhishek Kekane proposed openstack/security-doc master: Add OSSN-0111 for LUKS key logging  https://review.opendev.org/c/openstack/security-doc/+/101166813:33
JayFhttps://bugs.launchpad.net/ironic/+bug/2166507 is now public13:49
JayFpatches and ossa to come in the next hour13:49
JayFhttps://bugs.launchpad.net/ironic/+bug/2166510 is now public13:49
fungihttps://bugs.launchpad.net/zaqar/+bug/2161772 is now public13:53
opendevreviewMerged openstack/security-doc master: Add OSSN-0111 for LUKS key logging  https://review.opendev.org/c/openstack/security-doc/+/101166813:58
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-047] Ironic: Path injection to BMC (CVE-2026-90458)  https://review.opendev.org/c/openstack/ossa/+/101187714:06
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-048] Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187814:10
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-047] Ironic: Path injection to BMC (CVE-2026-90458)  https://review.opendev.org/c/openstack/ossa/+/101187714:16
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-048] Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187814:16
fungiJayF: see comments on 1011878, several things missed getting updated when you copied from the other ossa14:20
fungii didn't call out all instances of the wrong cve id, just the first one, in case that wasn't obvious14:21
JayFthanks for the close review14:24
JayFI'm still on the patches, we got a -1 on one of the patchse that was missed in embargo14:24
JayFnothing big for people who already patched, but I have like a dozen reviews to cleanup14:24
fungino problem, just didn't want it to get missed. i'm more effective at checking the boring details, less so at reviewing large blocks of prose14:25
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-048] Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187814:37
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-048] Ironic: Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187814:37
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-048] Ironic: Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187814:58
JayFgouthamr: rosmaita: ^ going to merge those soon with only fungi's review (technically he doesn't even have a +2 on the -048 anymore because I fixed a typo, but I'm still counting it)14:58
rosmaitaack, will take a quick look14:59
fungii've +2'd it again now, thanks15:01
rosmaitaJayF: +2 on both from me, too, want me to workflow them?15:07
JayFI just did :)15:07
JayFwhile the gate churns I'm going to go make some well-earned breakfast and do the announcements after15:09
JayFmaybe by then the master patches in ironic will be V+1 too15:09
opendevreviewMerged openstack/ossa master: [OSSA-2026-047] Ironic: Path injection to BMC (CVE-2026-90458)  https://review.opendev.org/c/openstack/ossa/+/101187715:18
opendevreviewMerged openstack/ossa master: [OSSA-2026-048] Ironic: Node maintenance policy bypass (CVE-2026-89419)  https://review.opendev.org/c/openstack/ossa/+/101187815:18
mgariepywould it be possible for the advisories to have a standardized messages like : "OSSA-YYYY-NNN: product: quick description" ?15:23
fungimgariepy: we do "Subject: [OSSA-$NUM] $PROJECT: $TITLE ($CVE)" in announcements per https://security.openstack.org/vmt-process.html#openstack-security-advisories-ossa15:25
mgariepyi was reffering to : https://security.openstack.org/ossalist.html15:25
fungiah, that has always been inconsistent, especially since a number of them affect more than one project15:26
mgariepyit could be a bit better, like if multiple projets, it can be a sorted  list or something15:27
fungithe other thing we'd have to decide is whether we go back and rename historical advisories for consistency (and retitle the corresponding bug reports too)15:28
mgariepymaybe just start with new one.15:32
JayFI think it's too tough to draw those clean lines in all places to make it a standard part15:41
JayFI should have put Ironic: in the title for 047 though15:44
JayFAnnouncements complete for OSSA-2026-047 and OSSA-2026-04815:53
JayFI've also informed MITRE to publish the associated CVEs.15:54
JayFhttps://bugs.launchpad.net/ironic/+bug/2171814 is now public16:15
fungitonyb: dmendiza[m]: are either of you interested in getting involved in vulnerabiltiy management soon? if not, i want to go ahead and prune the vmt membership to currently active participants for safety reasons16:58
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-TBD] Ironic Conductor gzip bomb dos  https://review.opendev.org/c/openstack/ossa/+/101192218:18
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-TBD] Ironic Conductor gzip bomb DoS  https://review.opendev.org/c/openstack/ossa/+/101192218:19
opendevreviewJay Faulkner proposed openstack/ossa master: [OSSA-2026-TBD] Ironic Conductor gzip bomb DoS  https://review.opendev.org/c/openstack/ossa/+/101192218:24
opendevreviewJay Faulkner proposed openstack/ossa master: Give launchpad "top billing" in reporting doc  https://review.opendev.org/c/openstack/ossa/+/101195721:29
JayFsomething I noticed ^ thought this would be an improvement21:29
JayFat least this way we ask reporters to try the bugtracker they have heard of first lol21:29
*** mrunge_ is now known as mrunge23:57
« Wednesday, 2026-10-21 Index

Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!