-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 22 Oct 2026 23:28:08 +0200 Source: ironic Architecture: source Version: 1:39.0.0-6 Distribution: unstable Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1151656 1151657 Changes: ironic (1:39.0.0-6) unstable; urgency=medium . * CVE-2026-90458 / OSSA-2026-047: Redfish vendor_passthru method allows path injection via ID. Applied upstream patch "Validate BMC subscription IDs in Redfish vendor passthrough methods" (Closes: #1151656): - CVE-2026-90458_OSSA-2026-047_Validate-BMC-subscription-IDs-in-....patch * CVE-2026-89419 / OSSA-2026-048: Ironic allows generic node update for maintenance setting. Applied upstream patch "Security: Fix maintenance state update policy bypass" (Closes: #1151657): - CVE-2026-89419_OSSA-2026-048_Security-Fix-maintenance-state-up....patch Checksums-Sha1: c22464733ffa3041e550a81f595e51f5d10b8d75 4101 ironic_39.0.0-6.dsc 5def75e030d36ae9d73af6f40cb471e9ff47b252 25932 ironic_39.0.0-6.debian.tar.xz e5b6d0c98b72e179b7eb29e7a94d4c48d7ff462a 22080 ironic_39.0.0-6_amd64.buildinfo Checksums-Sha256: ea3b489f8cf21f690449c969ac1e442a9422073e1b58b651405e274612f3c5e8 4101 ironic_39.0.0-6.dsc 06ac57dbc7a89eb4e5197c66e270f8f8c48924495a1c83f50b4f6d5f2035be48 25932 ironic_39.0.0-6.debian.tar.xz ae0dc88cab484fd376ddd648093d09c5690c10423f3537ef80799d5fdd56e82d 22080 ironic_39.0.0-6_amd64.buildinfo Files: ffb3b350e33a152b6d4ae7f3ad336aa3 4101 net optional ironic_39.0.0-6.dsc 0f62f8bf4f0fda901aaf88c18a852c61 25932 net optional ironic_39.0.0-6.debian.tar.xz e8b87764b72c8ebde6ef305a2d042590 22080 net optional ironic_39.0.0-6_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrahJ0ACgkQ1BatFaxr Q/6P7xAAn/dSaiMv+ax6QD6GpkYBcWpl+M5bjbkms2ezeSvVRx5O9JZRNAzWSys8 P2iID1ZXh9ZJ12AtXRvsZE9e5Yfr0jkua7VttYfHAkut6i1fym6fxSOWq8KVRj9G +od56eLM/05Ks6Y+Af3Dg2PCA4iBpPNqnoK5BNzk4a5WH4aEt2Ew0dz8xQhj8yLB cHBgDsulXgHK7MQ3f+GlFZXlZbFQ2UTPuqnmOg0Ql8orPpKZwc0L2pGVELp9EMIK P3C/o3IceN4yGpk10bDPwNlYku4LlUnzVk82q6j9xdFJ62xH+xie5NqlCKcKIEQe MrOuKFWNjlVAGxJoj9Xx0I363xsY9qtbfVref65x2eFmDPjf5kpiizYBUyjG+373 q2jl8Hi0w1xfK9YCFkD1i7cBG8hKkd2jh7lNEPUsTrMiy91g1RTSletGfFs4/FO6 Txjgo/AeQX6F+1PJs2SpBaW/UyhpNM36Z0u2NwHy98roeSSpFhwyR0J8F1u+2jJ4 VDtpIm6KpbnXSogrhAtpUlr99WJcJ1XuHg5MIWoCETTr+ygIAHgIEc3UN0wTQSKJ tdTh1b/yg2al43PpnW1dyG4/UDTVBSfHWKUx/Jrqcg/ANYA77v4yAxCTZOf6PaO4 IoOQJIJBRDK8yUvPHI0cwkcdTREBn/xqmWemdy3870JvEdjC7qs= =zH2o -----END PGP SIGNATURE-----
