Your message dated Thu, 06 Aug 2026 14:21:44 +0000
with message-id <[email protected]>
and subject line Bug#1143805: fixed in ironic-python-agent 11.5.0-5
has caused the Debian Bug report #1143805,
regarding OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143805: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143805
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ironic-python-agent
Version: 10.2.0-3
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce here:
https://wiki.openstack.org/wiki/OSSN/OSSN-0104
Summary:
Ironic-Python-Agent (IPA) has had support for several releases for configuring
your agent via multicast DNS (mDNS). This feature's design is such that, in
some extremely rare cases, a booted IPA could be reconfigured or directed to a
different Ironic API service.
Affected Services / Software:
ironic-python-agent: >=3.7.0 <11.6.2
Discussion:
When IPA is booted, the first thing it does is look for a valid URL to check
into the Ironic API or an Ironic Inspection service. The mDNS fallback would,
in situations where IPA had no API url configured, use mDNS lookups to
configure IPA, including the endpoint of the Ironic API service. This is
typically only used in rare cases for bootstrapping clusters with minimal
infrastructure using virtual media or physical USB thumb drives.
Ironic's default configuration always sends a valid API url. The current
development branch has been updated to always require an explicit opt-in to
mDNS fallback, either by setting ``ipa-api-url`` to ``mdns``, or by setting
``ipa-use-mdns`` to ``True`` on the command line.
Recommended Actions:
Ensure all IPA boots are managed by Ironic; do not boot any IPA ramdisks
without proper configuration. This is the default behavior but may be
different in environments with unique networking or DHCP configurations.
Operators utilizing the mDNS discovery features should, before upgrading
to 2026.2, ensure they are explicitly enabling mDNS fallback in their virtual
media images.
Patches:
The following patches are backwards incompatible and were not merged into
stable branches. Operators are welcome to backport them manually if they feel
it improves their security standing and they do not use mDNS fallback.
2026.2/hibiscus (development)
https://review.opendev.org/997637
https://review.opendev.org/997638
https://review.opendev.org/999337
Credits:
Dmitry Tantsur, Red Hat (Metal3.io Security Team)
Tuomo Tanskanen, Ericsson Software Technology (Metal3.io Security Team)
Authors:
Jay Faulkner, G-Research OSS
Notes:
This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0104
Original Launchpad bug:
https://bugs.launchpad.net/ironic-python-agent/+bug/2160054
Mailing List : [security-sig] tag on [email protected]
OpenStack Security : https://security.openstack.org/
CVE: none
--- End Message ---
--- Begin Message ---
Source: ironic-python-agent
Source-Version: 11.5.0-5
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ironic-python-agent, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated ironic-python-agent
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 06 Aug 2026 14:31:10 +0200
Source: ironic-python-agent
Architecture: source
Version: 11.5.0-5
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1143805
Changes:
ironic-python-agent (11.5.0-5) unstable; urgency=medium
.
* OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly. Applied
upstream patches:
- Make mDNS discovery explicitly opt-in
- Allow limiting what config can be set in mDNS
- Set a minimal default mdns config key list for IPA
(Closes: #1143805).
Checksums-Sha1:
1825ba868c793f3c4c83e7ce6eca9c6f920f22a3 2661 ironic-python-agent_11.5.0-5.dsc
1f0435c6ef4e1c232d2a743fc31cd76d27ebc530 19440
ironic-python-agent_11.5.0-5.debian.tar.xz
9d5c3127b1ba6670f045ea077ee7b849e219ea00 12488
ironic-python-agent_11.5.0-5_amd64.buildinfo
Checksums-Sha256:
380077a3d70a715faabfb1e511d38f7ee401efca1e6491065a8a925679a1287e 2661
ironic-python-agent_11.5.0-5.dsc
32a58804e8b3378d1c1b3b3baa8677a756da4f3ab04255a4a7027616b0fbc45c 19440
ironic-python-agent_11.5.0-5.debian.tar.xz
bd9196604154fee5cd754830acfe38741614d84616e197fe132e5608ff11387a 12488
ironic-python-agent_11.5.0-5_amd64.buildinfo
Files:
c84b889d81a9bc46b6b8185891090e5d 2661 net optional
ironic-python-agent_11.5.0-5.dsc
35af85e5dda8910cd4cada5e10054dc3 19440 net optional
ironic-python-agent_11.5.0-5.debian.tar.xz
96b265773bfa74d4f5a01545fdb236f0 12488 net optional
ironic-python-agent_11.5.0-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp0jr0ACgkQ1BatFaxr
Q/5dEBAAmI1oGb3JtazUIlvJxB1lHLVnXFWFbdIobDIeRe3/6RBoO0vvUF18JBmp
oXQYmCYrmaC9h3lgYnMRjyhzVd3DMQydAk7Qan2olLVWSSDTKCavUP1Uv3Tikkcc
vLfRHjy5w7QzPfDWGS8nBvw77oDK2Dg2ZaGCYkMze1bEukRy/QXrchyOnpQLD7ds
7k5qRsKJA5lbCjZ7wKZ/Fzvl1SFlYfYTAULsJH4kcJiPz6OveIwCmq1LLKcFqu3X
0+p9F0ZSESChl+qegeC/R863Qoq4wvBZIxmbZO6AzF0vUiHcFxWlvfU3cFgPyPRU
UpIGRdXn8t08p8IbG8q8Y8HFPgDy5wIfc7WLHwjQKAc2/vSYSeyOM7s+PErELq0M
+rd/LjWD7/4nloUAsGLZyCvHeUtQWzsFufyzB8+WgzsvyY+JchGY4ZF7fpt96TSC
3usMQzg6vB7MPmZxX6Tcv0H9xkWWjSwjtB6O4KTQ20YLHNyOoMgo6QN82THbc0Bp
L0wO9RmF7N+wOCx+uxnMpt17k4A6JWnVXwV+JhcwgTLWZhsjkpheHiyjbr5VjPov
rQADnFzPPtGcHJwrqMQsrupSKXuGNsZ+pWq4oof/g9gQJzuFaNUd+UJ9yKD5lJyb
jPcZ+RMLpZZKiykiFiokH8DwVie5ZN4kEbJJpMqm09oi44AqFos=
=t8k9
-----END PGP SIGNATURE-----
pgpikPYYO7QWC.pgp
Description: PGP signature
--- End Message ---
