-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 16 Jun 2026 12:46:11 +0200 Source: ironic Binary: ironic-api ironic-common ironic-conductor ironic-doc ironic-novncproxy python3-ironic Architecture: all Version: 1:29.0.5-0+deb13u3 Distribution: trixie-security Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Thomas Goirand Description: ironic-api - bare metal hypervisor API for OpenStack - API server ironic-common - bare metal hypervisor API for OpenStack - common files ironic-conductor - bare metal hypervisor API for OpenStack - conductor ironic-doc - bare metal hypervisor API for OpenStack - doc ironic-novncproxy - bare metal hypervisor API for OpenStack - NoVNC proxy python3-ironic - bare metal hypervisor API for OpenStack - Python lib Closes: 1140012 1140187 1141716 1141717 1144214 Changes: ironic (1:29.0.5-0+deb13u3) trixie-security; urgency=medium . * Add follow-up patch for CVE-2026-46447 (erata1): "Fix kernel parameter parsing for quoted values and whitespace". * CVE-2026-54421: Sensitive properties returned unredacted in POST and PATCH HTTP responses. Added upstream patch: "Fix sensitive properties returned on volume targets" (Closes: #1140012). * CVE-2026-43003 / OSSN-2026-0100: Command injection via chroot execution of tenant-controlled binaries. Added upstream patch: "Add an agent flag to disable installing boatloaders" (Closes: #1140187). * CVE-2026-44918: multiple related vulnerabilities in Ironic RBAC. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Applied upstream patch: "Prevent rehoming resources to nodes with different owner". (Closes: #1141716). * CVE-2026-54423: A malicious user with access to deploy a node directly via Ironic can specify the IPMI `send_raw` deployment step with a malicious payload and send commands to that nodes' BMC. Applied upstream patches: - Add operator-configurable step disallow lists - block vendor.send_raw (Closes: #1141717). * OSSN-0106: API ramdisk endpoints require network-level access controls. Added upstream patch: "Add [api] enable_ramdisk_endpoints config option" (Closes: #1144214). Checksums-Sha1: cc2c9ace5ba8242d9fa380c5ce933fb0b3263741 24896 ironic-api_29.0.5-0+deb13u3_all.deb b43326239af4a40def3f105ecf06852201146629 167592 ironic-common_29.0.5-0+deb13u3_all.deb e33c42119c75d0fb1d86d43aee43165679ddc693 11236 ironic-conductor_29.0.5-0+deb13u3_all.deb 9583d5445f8654897b79ef301e0b4a8ee6372194 3382444 ironic-doc_29.0.5-0+deb13u3_all.deb f0fe33cdb82fbadca8b4605586a434ebac694878 11168 ironic-novncproxy_29.0.5-0+deb13u3_all.deb 91654a34d0cb90524fb2f66673d8804edecd9c2f 22884 ironic_29.0.5-0+deb13u3_all-buildd.buildinfo cc0e367f394db417ded79dbf22f42bc49eb28726 1157368 python3-ironic_29.0.5-0+deb13u3_all.deb Checksums-Sha256: e2e61d2534557505a7ed59ac8c673e206a1506e5225a1659f6c2b3f3a5e74285 24896 ironic-api_29.0.5-0+deb13u3_all.deb 2e7f8ad9e07e734b0f8240aef0281b563ee563bdf93a3da67edd2307740d91c8 167592 ironic-common_29.0.5-0+deb13u3_all.deb b69bb8b4855b1b1a728171fce936614425d8ef74a3af7d869b7cc9087b70b7d6 11236 ironic-conductor_29.0.5-0+deb13u3_all.deb 6d612fa37a4bad6b495e23c48da111a7400a6ee3b6ae54c072679b4ecdf4e4ac 3382444 ironic-doc_29.0.5-0+deb13u3_all.deb 0e0befec7b4a3ff543c421ee2ea647c41580ab35451edadf82d78828c8abd42d 11168 ironic-novncproxy_29.0.5-0+deb13u3_all.deb 4da4d1ce9025af558ac0882c2a7700db058925b666d594d5b337b83db230641a 22884 ironic_29.0.5-0+deb13u3_all-buildd.buildinfo 2a11aabd9a7378c870eae181583b7bd9560f06b03b985e59a701eeba3fe8084d 1157368 python3-ironic_29.0.5-0+deb13u3_all.deb Files: 9d9c3051e86c3a855c0a91253551efbd 24896 net optional ironic-api_29.0.5-0+deb13u3_all.deb 52067ded9a860e76120715ddfaad6a36 167592 net optional ironic-common_29.0.5-0+deb13u3_all.deb ba7b56284c2e907f9e5a16192a65f3b3 11236 net optional ironic-conductor_29.0.5-0+deb13u3_all.deb f925e67511208c60885e56cd4e65c44a 3382444 doc optional ironic-doc_29.0.5-0+deb13u3_all.deb c1a6116b59ed278c247de4154242319a 11168 net optional ironic-novncproxy_29.0.5-0+deb13u3_all.deb ec0d249aab9ce1b97c77295b233237df 22884 net optional ironic_29.0.5-0+deb13u3_all-buildd.buildinfo 47e4885bced90a5fa62ba7af186b3441 1157368 python optional python3-ironic_29.0.5-0+deb13u3_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqBpyEACgkQPkCWRKsh 20ewLw/7BIjViGsC+EpK4fRrAE123oabWVjIYbhqaAOD66U3seggtOMoZEnrFFS1 QdWo2GINgRXRSUvPoS7FxwBblqbqkVL6TTBipNO+C8wZhrloWV9G4o+PU9bgSW1H q+Ts7qeLq2GCR5GZCDoxMWGkXGGl+7UAxlEm7f7bmf8tO1hs1jLEypQ3Ut3cqftO xbw/7PXcLT+QCnLOV2sjYBDtI7427/WQUbClrjv6j8/UHtOcHesphPMTJginbr3u JfOO1/uwXVsQkaddow7j4zYSAcSVrooFriXL0OZp7GDmLXOWFTvn2ye7zyOV/Xvo bPwc7bR7bqjukyotUFBpHcu2iNqoTHNmeb8bTAesy7uIfnn4miWzEWZjmjmXDkzp T2C8UrDSerZ5o18sUkqFU+S9CcLDmx3jiLNtefw1UiHJrHLRCMKUSFinnGG2pvLg Tau0elRqwoC2Lw4HQjVeDP48z4Yv4jLZ0Uw9VM4O5nkEvXnWntci8qNyGfa3jvbR OWcp8RYM71gwPQ9E4pxa/wt+47uZixTuF49YNla6P31R29ZfjYctLSnv+YcRyQMi 0pMeqvSkYYnY892BWrt0EB0EF+9rCIr+5TFmwhMFVHyk2VH40XK29enhwSR8tm2E IPwZjCUQqWng17zc50BW7YCe3Wy9wNDmmogcaY/Ol25vAheA+W4= =+OUE -----END PGP SIGNATURE-----