)]}'
{"id":"openstack%2Fmistral~1009474","triplet_id":"openstack%2Fmistral~master~Id749206e5581037721c23609770dc390cb5b4b59","project":"openstack/mistral","branch":"master","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Id749206e5581037721c23609770dc390cb5b4b59","subject":"Fix RCE via std.ssh_proxied proxy_command","status":"MERGED","created":"2026-10-08 14:10:40.000000000","updated":"2026-10-08 17:23:22.000000000","submitted":"2026-10-08 17:23:22.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009474-mistral-OSSA-2026-044","meta_rev_id":"e16b84b29f16f98c97be5a44ba3d10a9750108db","_number":1009474,"virtual_id_number":1009474,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 17:23:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 15:40:12.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 15:40:12.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 15:13:14.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"866563dfa6292a30a953c446813be468331e695e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:10:40.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"191f68021bcb7c174ace4ca570ba7676453c6ee7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 15:13:14.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/05947983eb3242a89e16ad0de3757e60\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/6636972894b647e38aa0db9be89a5070 : SUCCESS in 4m 44s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/ead45c71dab14ead87e59e5386a2be87 : SUCCESS in 10m 10s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/6de172e031f64f2f983dd829c9d35f19 : SUCCESS in 14m 28s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d83aae2fd09845dda8f07891bb5c99ef : SUCCESS in 8m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/295c9b867ae44197ba50d081dfdb6202 : SUCCESS in 3m 44s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6bda2bbf32a44d528c01629742b611df : SUCCESS in 17m 17s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/982a42292d1448c3aaccdd3b7638a6da : SUCCESS in 30m 52s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e620e1422e224a528f22dd1497d2b515 : SUCCESS in 41m 38s","accounts_in_message":[],"_revision_number":1},{"id":"2de9a015d45b41e72bc6f099a3f41de96a0bb77a","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 15:40:12.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"2d15b7bc80e30d8eb4f432c507bce00146fd9824","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 16:09:31.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"512d9e8f4217ee0445ce7e66489ffff7e234970a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:23:22.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/64fee4fd297f49c78f2982dace0fe1f8\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c77e1ecdbf024882a82681218d101af6 : SUCCESS in 4m 36s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/59f2741f78e647c39e28931225ba7e71 : SUCCESS in 11m 13s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/c5c5170056f448d688ddbe78d0846d9d : SUCCESS in 16m 08s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fa53fef2dcb74350a0730342d4a55358 : SUCCESS in 9m 28s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/43eacb635b894f2db6d0beffaa4aab46 : SUCCESS in 5m 46s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/dbd42c76494b4ee1a108667ec5a83e27 : SUCCESS in 17m 37s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9eeab4be9a3742c6ab5bc66f41bd82fd : SUCCESS in 47m 28s","accounts_in_message":[],"_revision_number":1},{"id":"e16b84b29f16f98c97be5a44ba3d10a9750108db","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:23:22.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"6f934fcc6bb483bfd4c3200ed4500764ba0219f8","revisions":{"6f934fcc6bb483bfd4c3200ed4500764ba0219f8":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:10:40.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/74/1009474/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/74/1009474/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/74/1009474/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/74/1009474/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/74/1009474/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/74/1009474/1"}}},"commit":{"parents":[{"commit":"24ce8a16a466a5b3f2f7903e812a1e596d9959d6","subject":"Only allow the owner of a resource to share it","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/24ce8a16a466a5b3f2f7903e812a1e596d9959d6"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 08:36:06.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:09:21.000000000","tz":120},"subject":"Fix RCE via std.ssh_proxied proxy_command","message":"Fix RCE via std.ssh_proxied proxy_command\n\nThe std.ssh_proxied action passed a caller-supplied proxy_command\nstraight to paramiko.ProxyCommand in execute_command_via_gateway.\nparamiko.ProxyCommand runs the string as a local subprocess on the\nexecutor host from its constructor - before any SSH authentication and\nindependently of the SSH credentials, gateway or target supplied (a bad\nor empty key does not stop it). std.ssh_proxied is a built-in action, so\nany authenticated, project-scoped user could run arbitrary commands on\nevery Mistral executor by submitting it through the action-execution\nAPI. This is a remote code execution vulnerability.\n\nGate proxy_command behind a new \u0027[action_std_ssh] allowed_proxy_commands\u0027\nallow-list (empty by default). execute_command_via_gateway now rejects,\nwith an ActionException, any proxy_command whose exact value is not\nlisted, before paramiko is invoked - so by default proxy_command is\ndisabled and no local subprocess can be spawned. Operators who rely on\nit must add the exact command string to the option. The rejection reason\nreaches the caller thanks to the preceding change.\n\nCloses-Bug: #2162100\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Id749206e5581037721c23609770dc390cb5b4b59\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/6f934fcc6bb483bfd4c3200ed4500764ba0219f8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/6f934fcc6bb483bfd4c3200ed4500764ba0219f8"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}