Your message dated Thu, 22 Oct 2026 22:14:23 +0000
with message-id <[email protected]>
and subject line Bug#1151656: fixed in ironic 1:39.0.0-6
has caused the Debian Bug report #1151656,
regarding CVE-2026-90458 / OSSA-2026-047: Redfish vendor_passthru method allows
path injection via ID
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151656: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151656
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ironic
Version: 1:29.0.5-0+deb13u3
Severity: serious
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-047.html
Date: October 22, 2026
:CVE: CVE-2026-90458
Affects
~~~~~~~
- Ironic: >=18.1.0 <=29.1.1, >30.0.0 <=32.1.1, >33.0.0 <=35.1.1, >36.0.0
<=39.0.1
Description
~~~~~~~~~~~
The Metal3.io Security team reported a vulnerability in Ironic's API.
When calling the ``vendor_passthru`` API endpoint provided by the
``redfish`` management interface to create or delete a subscription,
a malicious System-scoped Administrator could instead perform an HTTP
DELETE or HTTP GET on an arbitrary path on a node's BMC. In a worst
case scenario, this could lead to user accounts being deleted from
the Redfish service on the BMC.
Only clouds with nodes enrolled in a redfish hardware type are
susceptible to this vulnerability.
Patches
~~~~~~~
- https://review.opendev.org/1011870 (2024.1/caracal (unmaintained))
- https://review.opendev.org/1011868 (2025.1/epoxy)
- https://review.opendev.org/1011866 (2025.2/flamingo)
- https://review.opendev.org/1011864 (2026.1/gazpacho)
- https://review.opendev.org/1011862 (2026.2/hibiscus)
- https://review.opendev.org/1011860 (2027.1/indri (development))
- https://review.opendev.org/1011874 (Bugfix/37.0)
- https://review.opendev.org/1011872 (Bugfix/38.0)
Credits
~~~~~~~
- Tuomo Tanskanen, Metal3.io Security Team from Ericsson Software Technology
(CVE-2026-90458)
- Dmitry Tantsur, Metal3.io Security Team from Red Hat (CVE-2026-90458)
References
~~~~~~~~~~
- https://launchpad.net/bugs/2166507
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90458
Notes
~~~~~
- Patches for unmaintained/2024.1, bugfix/38.0 and bugfix/37.0 will be
merged to git but no new release will be provided.
--- End Message ---
--- Begin Message ---
Source: ironic
Source-Version: 1:39.0.0-6
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ironic, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated ironic package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 23:28:08 +0200
Source: ironic
Architecture: source
Version: 1:39.0.0-6
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1151656 1151657
Changes:
ironic (1:39.0.0-6) unstable; urgency=medium
.
* CVE-2026-90458 / OSSA-2026-047: Redfish vendor_passthru method allows path
injection via ID. Applied upstream patch "Validate BMC subscription IDs
in Redfish vendor passthrough methods" (Closes: #1151656):
- CVE-2026-90458_OSSA-2026-047_Validate-BMC-subscription-IDs-in-....patch
* CVE-2026-89419 / OSSA-2026-048: Ironic allows generic node update for
maintenance setting. Applied upstream patch "Security: Fix maintenance
state update policy bypass" (Closes: #1151657):
- CVE-2026-89419_OSSA-2026-048_Security-Fix-maintenance-state-up....patch
Checksums-Sha1:
c22464733ffa3041e550a81f595e51f5d10b8d75 4101 ironic_39.0.0-6.dsc
5def75e030d36ae9d73af6f40cb471e9ff47b252 25932 ironic_39.0.0-6.debian.tar.xz
e5b6d0c98b72e179b7eb29e7a94d4c48d7ff462a 22080 ironic_39.0.0-6_amd64.buildinfo
Checksums-Sha256:
ea3b489f8cf21f690449c969ac1e442a9422073e1b58b651405e274612f3c5e8 4101
ironic_39.0.0-6.dsc
06ac57dbc7a89eb4e5197c66e270f8f8c48924495a1c83f50b4f6d5f2035be48 25932
ironic_39.0.0-6.debian.tar.xz
ae0dc88cab484fd376ddd648093d09c5690c10423f3537ef80799d5fdd56e82d 22080
ironic_39.0.0-6_amd64.buildinfo
Files:
ffb3b350e33a152b6d4ae7f3ad336aa3 4101 net optional ironic_39.0.0-6.dsc
0f62f8bf4f0fda901aaf88c18a852c61 25932 net optional
ironic_39.0.0-6.debian.tar.xz
e8b87764b72c8ebde6ef305a2d042590 22080 net optional
ironic_39.0.0-6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrahJ0ACgkQ1BatFaxr
Q/6P7xAAn/dSaiMv+ax6QD6GpkYBcWpl+M5bjbkms2ezeSvVRx5O9JZRNAzWSys8
P2iID1ZXh9ZJ12AtXRvsZE9e5Yfr0jkua7VttYfHAkut6i1fym6fxSOWq8KVRj9G
+od56eLM/05Ks6Y+Af3Dg2PCA4iBpPNqnoK5BNzk4a5WH4aEt2Ew0dz8xQhj8yLB
cHBgDsulXgHK7MQ3f+GlFZXlZbFQ2UTPuqnmOg0Ql8orPpKZwc0L2pGVELp9EMIK
P3C/o3IceN4yGpk10bDPwNlYku4LlUnzVk82q6j9xdFJ62xH+xie5NqlCKcKIEQe
MrOuKFWNjlVAGxJoj9Xx0I363xsY9qtbfVref65x2eFmDPjf5kpiizYBUyjG+373
q2jl8Hi0w1xfK9YCFkD1i7cBG8hKkd2jh7lNEPUsTrMiy91g1RTSletGfFs4/FO6
Txjgo/AeQX6F+1PJs2SpBaW/UyhpNM36Z0u2NwHy98roeSSpFhwyR0J8F1u+2jJ4
VDtpIm6KpbnXSogrhAtpUlr99WJcJ1XuHg5MIWoCETTr+ygIAHgIEc3UN0wTQSKJ
tdTh1b/yg2al43PpnW1dyG4/UDTVBSfHWKUx/Jrqcg/ANYA77v4yAxCTZOf6PaO4
IoOQJIJBRDK8yUvPHI0cwkcdTREBn/xqmWemdy3870JvEdjC7qs=
=zH2o
-----END PGP SIGNATURE-----
pgpGcLvKzRjQK.pgp
Description: PGP signature
--- End Message ---
