-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 26 Jun 2026 11:18:54 +0200 Source: ironic Architecture: source Version: 1:35.0.1-8 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1141716 1141717 Changes: ironic (1:35.0.1-8) unstable; urgency=high . * CVE-2026-44918: multiple related vulnerabilities in Ironic RBAC. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Applied upstream patch: "Prevent rehoming resources to nodes with different owner". (Closes: #1141716). * CVE-2026-54423: A malicious user with access to deploy a node directly via Ironic can specify the IPMI `send_raw` deployment step with a malicious payload and send commands to that nodes' BMC. Applied upstream patches: - Add operator-configurable step disallow lists - block vendor.send_raw (Closes: #1141717). Checksums-Sha1: 7b32af2af84e570b70b714d11966b2f0755a01c0 4063 ironic_35.0.1-8.dsc ba0c2c412bc91c9a076bd71b429dfb0f96cc916e 59472 ironic_35.0.1-8.debian.tar.xz 133f3cd34757667cc3781d330df9f3e0d7763a35 23030 ironic_35.0.1-8_amd64.buildinfo Checksums-Sha256: ffe07659d7ae7193d24021f758a7ad5a3a8f598627b9e121b62ee17ce10fa016 4063 ironic_35.0.1-8.dsc a06daa131052abd9194116f74e5a67a4cfa26dbda943ee408a53bd17be138cde 59472 ironic_35.0.1-8.debian.tar.xz e963d695d01d3ff3e76e415974a1a80ad32b852f7b36e46d2b03e66ae83f2839 23030 ironic_35.0.1-8_amd64.buildinfo Files: 4b8f52a196bbdc9f895deb5e096beaaa 4063 net optional ironic_35.0.1-8.dsc 89ee0b1b51188f2e32be1de035b98273 59472 net optional ironic_35.0.1-8.debian.tar.xz 7741b488f2e1025d378a5a12783f778e 23030 net optional ironic_35.0.1-8_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmpPjo8ACgkQ1BatFaxr Q/7plRAAjjBaOmsvZKAzjV23s41IpHh5SMU9jW2lIBM8XMshMOfaYMtNxrsIe1Q7 xSqixPHxMwhga3Gmwde9sB4qUYpChr7DYnw5W9PhkEQnpyuGcSijL+1dKoEgD/hJ MEc8zM9FNaqxgZshG+EPS/NDUzq1KoEDSTuFeobJSfLIIAWtQbjWpdR+uc4zXQ+L 2GdqYX38on2abO21Jz2JtYRt8t8vex9+JQsBfVk2PmtTrFII7LZK5O2d9NEk+/qv bFHdk11qZCkNGJ62YHMGn/1VNWxbJDWx2zcLIC02GWK3OzTV6Y8/Ej0A2OMjwdtG s1fKQjPT/NY6m/5pulxEidtN0pdDq3HH6VG00Fi7yrYnofajXVHuds5ZWDJroHei Hr20hPkowOoWtSm1vsbSeD2J3tEUVZ5iRZAf3VYHIalSYRrjxlAp+IZZI4oTgYnu g3jHCuMqT6weLTQ63gAGxPnrug7wIWTXxHM2XfFehZvjUTbepPM0RAGzYYVsDu+r wRTEitHzlnw5y+TnhsQDNZdJrjamX74LlofUirbcxInXW/mVmZHzv5ZC9p1KvFQ5 XyShzpl4uRfZkrt35f69pskslGoB2i5J2HGq342bea5pVCVF/Xh+FwTtEbhCcVSK yEg8zPkXfU06wMFtzd9bBTF5YZQ2nKEUtjY9rqz/UUJbfNnYknw= =A1ji -----END PGP SIGNATURE-----
