-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 09 Nov 2026 17:49:45 +0100 Source: ironic-python-agent Architecture: source Version: 10.2.0-3+deb13u1 Distribution: trixie Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1135646 1142857 1142943 Changes: ironic-python-agent (10.2.0-3+deb13u1) trixie; urgency=high . * CVE-2026-43003: Command injection via chroot execution of tenant-controlled binaries. Applied upstream patch: "Add a flag to disable installing bootloaders" (Closes: #1135646). * CVE-2026-66138 / OSSA-2026-027: command execution via unsanitized config. Applied upstream patch: "fix NTP command handling" (Closes: #1142857). * CVE-2026-54422 / OSSA-2026-028: credential extraction from Ironic Python Agent via malicious container. Applied upstream patch: "Do not expose registry pull secret to bootc container" (Closes: #1142943). Checksums-Sha1: 0eaaefc3aebbb911575c52962e0b56caf1df18aa 2714 ironic-python-agent_10.2.0-3+deb13u1.dsc 5c9a7a9472e81ff6bbda50408faa17878a85dd9a 15064 ironic-python-agent_10.2.0-3+deb13u1.debian.tar.xz ba60a9b46e17f7716133f4072d89a3dc353c76e5 13297 ironic-python-agent_10.2.0-3+deb13u1_amd64.buildinfo Checksums-Sha256: 6dffd71fb7ea7bed595a9ad633530e6072bf334b8f72f0255147d15014f973b6 2714 ironic-python-agent_10.2.0-3+deb13u1.dsc 3172d0c4802023f4c9a9f4e2cf0fb7016bd7be6465f188b0ddbcc07170a71ca0 15064 ironic-python-agent_10.2.0-3+deb13u1.debian.tar.xz 72241fd15a9955129d31bec94dec65f765a84b17602b6bf23094c8e7a649f037 13297 ironic-python-agent_10.2.0-3+deb13u1_amd64.buildinfo Files: 57f88ed1a72d6bd277ebed781163c927 2714 net optional ironic-python-agent_10.2.0-3+deb13u1.dsc 4022ca0466f69b3e9be080d84b0aba91 15064 net optional ironic-python-agent_10.2.0-3+deb13u1.debian.tar.xz cd849d41a0d388fb9ce90f4bd5b5bb59 13297 net optional ironic-python-agent_10.2.0-3+deb13u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmr0KFkACgkQ1BatFaxr Q/7YExAAheUBqU962JOVknz4mUrpMZ7NrxafmpTZVIlo1CHTAP4hiqDAP9Ts+Zy2 H5KgBu07DxBsO5EQO2Ol/L2wR2kiqXZCo9kBYNElwuv0FrYmlSXurcvcUM7jXcT3 hEKcYfxX3A1PTXmsekUC07qjU+PXT2lWWC31klb5bHpkj97ilFiBOt7mMs5Zn79c R4KaOpE0McL8OBDYpK7T+wwJ6+TCLnazX/kJySbw/ToX7/181p3XZrRLWHOylFs/ 7l7E7XKGVFi/naUdeaCbMGm6dzWLxaTbuUCJvvFa+QK3JZpoUSyBKrhK95QtFiVb enxjwMOofUNb3xu1gFG3ZmDxG3jXNdiBDBIEZ/NNO0AEaIav2aDOo/gwKTbvxkUa 2GaxNs9EPRXKl3hkUDV9sOSjOck9Ndgql3kNOZ2fPiyWUF7+WEam/rudBetZVdbf 1LnPkH3QdwZb3W1c6gB5n+qPHT+3h9shizck9m6T2SXHoI223YJ1Qt2/2gwCLQmb b1Rv7OsuqCyGziT/cV18OC7HS6xyg+WVFu8b7G86AMZer/HuGwsoSs+MaYI1Cn1E h0HyOm2tqdZ+WfTPgW4cBhyNt8s7IU3kJxGICmXdduOvudhJUFJTCMFlQwXDPLwM epLnkbQqeMiLLP7sAEN5JMx7KG3cPo3YK2kIeTxgAc2AqAAjLQA= =nvuS -----END PGP SIGNATURE-----
