Debian Patches
Status for ironic-python-agent/11.5.0-4
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| fix-syntax-warning.patch | Fix syntax warning =================================================================== |
Thomas Goirand <zigo@debian.org> | no | debian | 2025-01-02 | |
| CVE-2026-43003_Add_a_flag_to_disable_installing_bootloaders.patch | CVE-2026-43003: Add a flag to disable installing bootloaders Disables bootloader installations (calls to grub-install) for security reasons as part of the mitigation for CVE-2026-43003. diff --git a/ironic_python_agent/agent.py b/ironic_python_agent/agent.py index 4d8406c..66bc29c 100644 |
Clif Houck <me@clifhouck.com> | yes | upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/993016 | 2026-06-17 |
| CVE-2026-66138_OSSA-2026-027_fix_NTP_command_handling.patch | Adds basic validation of the NTP server parameter to harden the usage of the NTP server time setting *AND* also uses shlex.quote to and removes shell=true from the execution invocation to prevent any possibliity of injecting a malicious command to be executed. diff --git a/ironic_python_agent/tests/unit/extensions/test_standby.py b/ironic_python_agent/tests/unit/extensions/test_standby.py index 29acdac..acac1ec 100644 |
Julia Kreger <juliaashleykreger@gmail.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/998488 | 2026-07-28 |
| CVE-2026-54422-OSSA-2026-028_Do_not_expose_registry_pull_secret_to_bootc_container.patch | Do not expose registry pull secret to bootc container During bootc deployment, the registry pull secret (authfile) was written to a well-known path on the host and passed to 'podman run --privileged --pid=host --authfile=...'. Because the container runs with host PID namespace visibility, tenant-controlled code in the bootc image could read the credential via /proc/1/root/<authfile-path>. . When the pull secret originates from an operator/admin source (driver_info.image_pull_secret, [deploy] image_server_user/password, or [oci] authentication_config) rather than the tenant's own instance_info.image_pull_secret, this constitutes a cross-boundary credential disclosure: a project-scoped node owner member recovers the operator's registry credential, which may be shared across nodes, projects, or the entire conductor. . Fix by splitting the authenticated image pull from the container execution: . 1. Write the auth file to a random temporary path (not the well-known ~/.config/containers/auth.json). 2. Run 'podman pull --authfile=<tmpfile>' to fetch and cache the image in the local store. 3. Delete the auth file in a finally block, guaranteeing cleanup even on pull failure. 4. Run 'podman run' without --authfile. The image is already cached locally and --skip-fetch-check is already in use, so no registry credential is needed at runtime. . By the time tenant container code executes, the credential file no longer exists on the host filesystem and cannot be read via /proc/1/root. diff --git a/ironic_python_agent/extensions/standby.py b/ironic_python_agent/extensions/standby.py index 31d705d..72acb48 100644 |
Steve Baker <sbaker@redhat.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/998481 | 2026-07-28 |