| *** mrunge_ is now known as mrunge | 00:47 | |
| fungi | https://bugs.launchpad.net/freezer/+bug/2167261 is now public | 17:10 |
|---|---|---|
| fungi | https://bugs.launchpad.net/glance/+bug/2172284 is now public | 17:10 |
| fungi | tonyb: dmendiza[m]: are either of you interested in getting involved in vulnerabiltiy management soon? if not, i want to go ahead and prune the vmt membership to currently active participants for safety reasons | 17:27 |
| JayF | fungi: FWIW OSSA for Ironic gzip bomb won't be today; we had to revise the patches and they are back under review. I'm about to revise the OSSA again; blast radius is slightly larger (not too bad though) | 19:20 |
| fungi | makes sense. glance now has two similar bugs public | 19:22 |
| fungi | (related to unconstrained decompression of disk images, or constraints being applied too late to do any good) | 19:23 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: [OSSA-2026-TBD] Ironic Conductor gzip bomb DoS https://review.opendev.org/c/openstack/ossa/+/1011922 | 19:33 |
| JayF | While ^ can't be advisoried until the ironic patches in question pass review, it should be reasonable to review at this time | 19:33 |
| fungi | thanks, looking | 19:38 |
| fungi | JayF: marked a handful of non-blocking nits inline in case you do any other revisions, but lgtm | 19:58 |
| fungi | though i guess you'll do revisions to set the ossa number and date anyway | 19:59 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: [OSSA-2026-049] Ironic Conductor gzip bomb DoS https://review.opendev.org/c/openstack/ossa/+/1011922 | 22:25 |
| JayF | fungi: gouthamr: ^ updated for feedback | 22:25 |
| gouthamr | ty JayF | 22:30 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: [OSSA-2026-049] Ironic Conductor gzip bomb DoS (CVE-2026-115638) https://review.opendev.org/c/openstack/ossa/+/1011922 | 22:37 |
| fungi | lgtm now, thanks again! | 22:40 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!