)]}'
{"id":"openstack%2Fmistral~1009490","triplet_id":"openstack%2Fmistral~stable%2F2026.1~Id749206e5581037721c23609770dc390cb5b4b59","project":"openstack/mistral","branch":"stable/2026.1","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Id749206e5581037721c23609770dc390cb5b4b59","subject":"Fix RCE via std.ssh_proxied proxy_command","status":"MERGED","created":"2026-10-08 14:14:04.000000000","updated":"2026-10-08 19:01:43.000000000","submitted":"2026-10-08 19:01:43.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009490-mistral-OSSA-2026-044","meta_rev_id":"a14066848dbb0eaa02ada65da02f229a55c5bcdd","_number":1009490,"virtual_id_number":1009490,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-08 19:01:43.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 17:43:58.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 17:43:58.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 16:57:56.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"fde3d389034df5437a2f4e3045148335cf327355","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:14:04.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"efb168b67454e3ef4069afab6602797ccd0d433c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 16:57:56.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/16b965b45b2f44be9889277a761fd4c0\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e2e451d42301469da13b9c268fc2b3aa : SUCCESS in 2m 46s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/af0cf2fe7e7f4dcaad04f1e5fe4c5e67 : SUCCESS in 11m 09s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/7e3d4fb6ce364bae9de52e70fad9cb8a : SUCCESS in 11m 00s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/841ea2b5dc7145a7a9d49c8d0929e8c7 : SUCCESS in 15m 30s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a8f4d205ea694e57a89b8defff541cb2 : SUCCESS in 9m 08s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d7196638d7ae46fca0f3c6dc693590cb : SUCCESS in 6m 01s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/82e4644620ba46b2ba3d106bcc3d7c89 : SUCCESS in 17m 29s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/8a3f03db435844fcb238b0ab28049377 : SUCCESS in 39m 35s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/aa2fe0bb12424eba8f934c3a4d1478c1 : SUCCESS in 49m 44s","accounts_in_message":[],"_revision_number":1},{"id":"022f4030be67e3a09f2470e02d98e4305c484509","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 17:43:58.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"6dc925b6c0f8e73cf9c50167eaf2f4d2a9ddce3d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 17:47:12.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"3b8662f345da3496170c14b7881f614a97bbfa18","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:43.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/448318d393d6411593e1cbd55ade3142\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/691396e8e16d4f07a503f2adc22981ca : SUCCESS in 4m 35s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a2698d83310d471f8771c567f57f5ab5 : SUCCESS in 10m 46s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a1d4276b9e6e4a38bbdcb35edb6be8fa : SUCCESS in 10m 00s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9bef8c91cfef409597d5cffcce898755 : SUCCESS in 10m 56s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7b24d88bdb314456b628ed27d320c583 : SUCCESS in 4m 34s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/fb2c580850074a89a395775adcf01b31 : SUCCESS in 25m 54s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/544c8e0db35f439bbfe5939d874380c3 : SUCCESS in 42m 24s","accounts_in_message":[],"_revision_number":1},{"id":"a14066848dbb0eaa02ada65da02f229a55c5bcdd","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 19:01:43.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"6a80187ccf52825e0d87fd587bf7993368a643e9","revisions":{"6a80187ccf52825e0d87fd587bf7993368a643e9":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:14:04.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/90/1009490/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/90/1009490/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/90/1009490/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/90/1009490/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/90/1009490/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/90/1009490/1"}}},"commit":{"parents":[{"commit":"8e7f5dad1a887ac951002f16120843ec5dd7ae96","subject":"Only allow the owner of a resource to share it","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/8e7f5dad1a887ac951002f16120843ec5dd7ae96"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 08:36:06.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:13:49.000000000","tz":120},"subject":"Fix RCE via std.ssh_proxied proxy_command","message":"Fix RCE via std.ssh_proxied proxy_command\n\nThe std.ssh_proxied action passed a caller-supplied proxy_command\nstraight to paramiko.ProxyCommand in execute_command_via_gateway.\nparamiko.ProxyCommand runs the string as a local subprocess on the\nexecutor host from its constructor - before any SSH authentication and\nindependently of the SSH credentials, gateway or target supplied (a bad\nor empty key does not stop it). std.ssh_proxied is a built-in action, so\nany authenticated, project-scoped user could run arbitrary commands on\nevery Mistral executor by submitting it through the action-execution\nAPI. This is a remote code execution vulnerability.\n\nGate proxy_command behind a new \u0027[action_std_ssh] allowed_proxy_commands\u0027\nallow-list (empty by default). execute_command_via_gateway now rejects,\nwith an ActionException, any proxy_command whose exact value is not\nlisted, before paramiko is invoked - so by default proxy_command is\ndisabled and no local subprocess can be spawned. Operators who rely on\nit must add the exact command string to the option. The rejection reason\nreaches the caller thanks to the preceding change.\n\nCloses-Bug: #2162100\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Id749206e5581037721c23609770dc390cb5b4b59\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/6a80187ccf52825e0d87fd587bf7993368a643e9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/6a80187ccf52825e0d87fd587bf7993368a643e9"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}