Debian Patches
Status for ironic-python-agent/11.5.0-5
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| fix-syntax-warning.patch | Fix syntax warning =================================================================== |
Thomas Goirand <zigo@debian.org> | no | debian | 2025-01-02 | |
| CVE-2026-43003_Add_a_flag_to_disable_installing_bootloaders.patch | CVE-2026-43003: Add a flag to disable installing bootloaders Disables bootloader installations (calls to grub-install) for security reasons as part of the mitigation for CVE-2026-43003. diff --git a/ironic_python_agent/agent.py b/ironic_python_agent/agent.py index 4d8406c..66bc29c 100644 |
Clif Houck <me@clifhouck.com> | yes | upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/993016 | 2026-06-17 |
| CVE-2026-66138_OSSA-2026-027_fix_NTP_command_handling.patch | Adds basic validation of the NTP server parameter to harden the usage of the NTP server time setting *AND* also uses shlex.quote to and removes shell=true from the execution invocation to prevent any possibliity of injecting a malicious command to be executed. diff --git a/ironic_python_agent/tests/unit/extensions/test_standby.py b/ironic_python_agent/tests/unit/extensions/test_standby.py index 29acdac..acac1ec 100644 |
Julia Kreger <juliaashleykreger@gmail.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/998488 | 2026-07-28 |
| CVE-2026-54422-OSSA-2026-028_Do_not_expose_registry_pull_secret_to_bootc_container.patch | Do not expose registry pull secret to bootc container During bootc deployment, the registry pull secret (authfile) was written to a well-known path on the host and passed to 'podman run --privileged --pid=host --authfile=...'. Because the container runs with host PID namespace visibility, tenant-controlled code in the bootc image could read the credential via /proc/1/root/<authfile-path>. . When the pull secret originates from an operator/admin source (driver_info.image_pull_secret, [deploy] image_server_user/password, or [oci] authentication_config) rather than the tenant's own instance_info.image_pull_secret, this constitutes a cross-boundary credential disclosure: a project-scoped node owner member recovers the operator's registry credential, which may be shared across nodes, projects, or the entire conductor. . Fix by splitting the authenticated image pull from the container execution: . 1. Write the auth file to a random temporary path (not the well-known ~/.config/containers/auth.json). 2. Run 'podman pull --authfile=<tmpfile>' to fetch and cache the image in the local store. 3. Delete the auth file in a finally block, guaranteeing cleanup even on pull failure. 4. Run 'podman run' without --authfile. The image is already cached locally and --skip-fetch-check is already in use, so no registry credential is needed at runtime. . By the time tenant container code executes, the credential file no longer exists on the host filesystem and cannot be read via /proc/1/root. diff --git a/ironic_python_agent/extensions/standby.py b/ironic_python_agent/extensions/standby.py index 31d705d..72acb48 100644 |
Steve Baker <sbaker@redhat.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/998481 | 2026-07-28 |
| OSSN-0104_1_Make_mDNS_discovery_explicitly_opt-in.patch | Security: Make mDNS discovery explicitly opt-in mDNS discovery was enabled in a few cases implicitly; e.g. if no ipa-api-url was set. We've removed the ability for mDNS to be implicitly set by missing configuration and instead require explicit enablement by setting the ``ipa-api-url`` to mdns, setting ``[mdns]/use_mdns=true`` in the ``ironic_python_agent.conf``, or setting ``ipa-use-mdns=true`` via the kernel command line. =================================================================== |
Jay Faulkner <jay@jvf.cc> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/997637 | 2026-08-06 |
| OSSN-0104_2_Allow_limiting_what_config_can_be_set_in_mDNS.patch | [PATCH] Allow limiting what config can be set in mDNS Currently, mDNS allows any configuration value to be set -- including those which may have security implications. This adds a framework for allowing only limited configuration variables to be overridden. . The current default, None, does nothing to modify default behavior. A future change will populate this list with sensible defaults. =================================================================== |
Jay Faulkner <jay@jvf.cc> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/997638 | 2026-08-06 |
| OSSN-0104_3_Set_a_minimal_default_mdns_config_key_list_for_IPA.patch | [PATCH] Set a minimal default mdns config key list for IPA The most *minimal* parameter which may be needed by default is an NTP server key for IPA to force time sync, which may be needed if someone is, for example, booting a data center hosts which have been powered off or are deeply out of sync such that otherwise they would be unable to connect to Ironic services because of the potential time delta. =================================================================== |
Julia Kreger <juliaashleykreger@gmail.com> | no | debian | upstream, https://review.opendev.org/c/openstack/ironic-python-agent/+/999337 | 2026-08-06 |