)]}'
{"id":"openstack%2Fmistral~1009508","triplet_id":"openstack%2Fmistral~stable%2F2025.1~Id749206e5581037721c23609770dc390cb5b4b59","project":"openstack/mistral","branch":"stable/2025.1","topic":"mistral-OSSA-2026-044","hashtags":[],"change_id":"Id749206e5581037721c23609770dc390cb5b4b59","subject":"Fix RCE via std.ssh_proxied proxy_command","status":"MERGED","created":"2026-10-08 14:20:54.000000000","updated":"2026-10-09 13:23:34.000000000","submitted":"2026-10-09 13:23:34.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009508-mistral-OSSA-2026-044","meta_rev_id":"c23c824122a5312459b4952ffe31474ab5bf89ac","_number":1009508,"virtual_id_number":1009508,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-09 13:23:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-10-08 19:27:48.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-10-08 19:27:48.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-08 16:57:58.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"92528f935f9038801a30c2a902eb3e66ba265a8f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 14:20:54.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"26e2abdd0157d89584169d3ec331a244ab983c73","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-08 16:57:58.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/077b9656a19f4b27b349a09179c9ff4f\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/283d6e9acd664659a33320ff93ce350f : SUCCESS in 4m 37s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/f496f596aa024a088e985cb07b2cbae1 : SUCCESS in 9m 55s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/04c0833b1c13400c92131cfe07c21138 : SUCCESS in 9m 51s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/834ec1545b1249c2a67450dc90834b2c : SUCCESS in 10m 20s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/548f396f311942578d7a34707e47e0eb : SUCCESS in 4m 31s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8fe8fa7f3ae44e10b30aad0c8071ee00 : SUCCESS in 15m 33s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/eaa3a511f61e4fb69af2744d724137f0 : SUCCESS in 18m 28s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ad9b6496df6a4424838329fd9f061ca7 : SUCCESS in 45m 30s\n- mistral-devstack-non-apache https://zuul.opendev.org/t/openstack/build/1fc7601aab7e44839428011956901734 : SUCCESS in 23m 44s\n- mistral-devstack-kombu https://zuul.opendev.org/t/openstack/build/97dab6a6072a4812958529b278c83e61 : SUCCESS in 18m 34s","accounts_in_message":[],"_revision_number":1},{"id":"232f5af5ed59ccd9b692dc9c6b117b5319d12f79","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-10-08 19:27:48.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"86a05fab16b11cc44bc20711b4b8aff2737f10a2","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-09 12:27:18.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"977a032795f30438bb8e96405a3d62949979230f","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-09 13:23:34.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/523b35cc941b483aab7c7fe11b153e81\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/90f558b3f3234f4eb73879d3c8c38656 : SUCCESS in 2m 31s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/4b28f8811a604f399833d29270a1baef : SUCCESS in 13m 25s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/7b336e91891149c3b09b31fc92ff2d5c : SUCCESS in 12m 57s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3cfeaad71fd640ffa433a43ca0214f02 : SUCCESS in 9m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d28f687cc93c42168c6d934f9cbbdebe : SUCCESS in 8m 45s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/8b52208ee72f4476b0982b0fe5432b80 : SUCCESS in 40m 28s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/956b8c72c4a54436b651824300d51493 : SUCCESS in 24m 22s\n- mistral-devstack-non-apache https://zuul.opendev.org/t/openstack/build/128907d491e74fab8ea6a94ad2c5a375 : SUCCESS in 45m 19s\n- mistral-devstack-kombu https://zuul.opendev.org/t/openstack/build/305a2520a4ac4eae99a4390b437ad06a : SUCCESS in 43m 14s","accounts_in_message":[],"_revision_number":1},{"id":"c23c824122a5312459b4952ffe31474ab5bf89ac","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-09 13:23:34.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"49ce742eb8c2d66a93f93fd5a232b018695ebc1c","revisions":{"49ce742eb8c2d66a93f93fd5a232b018695ebc1c":{"kind":"REWORK","_number":1,"created":"2026-10-08 14:20:54.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/08/1009508/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/08/1009508/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/08/1009508/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/08/1009508/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/08/1009508/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/08/1009508/1"}}},"commit":{"parents":[{"commit":"a8387c10469315e10a88d0ead30539bd5b8c9063","subject":"Only allow the owner of a resource to share it","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/a8387c10469315e10a88d0ead30539bd5b8c9063"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-26 08:36:06.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-10-08 14:20:13.000000000","tz":120},"subject":"Fix RCE via std.ssh_proxied proxy_command","message":"Fix RCE via std.ssh_proxied proxy_command\n\nThe std.ssh_proxied action passed a caller-supplied proxy_command\nstraight to paramiko.ProxyCommand in execute_command_via_gateway.\nparamiko.ProxyCommand runs the string as a local subprocess on the\nexecutor host from its constructor - before any SSH authentication and\nindependently of the SSH credentials, gateway or target supplied (a bad\nor empty key does not stop it). std.ssh_proxied is a built-in action, so\nany authenticated, project-scoped user could run arbitrary commands on\nevery Mistral executor by submitting it through the action-execution\nAPI. This is a remote code execution vulnerability.\n\nGate proxy_command behind a new \u0027[action_std_ssh] allowed_proxy_commands\u0027\nallow-list (empty by default). execute_command_via_gateway now rejects,\nwith an ActionException, any proxy_command whose exact value is not\nlisted, before paramiko is invoked - so by default proxy_command is\ndisabled and no local subprocess can be spawned. Operators who rely on\nit must add the exact command string to the option. The rejection reason\nreaches the caller thanks to the preceding change.\n\nCloses-Bug: #2162100\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Id749206e5581037721c23609770dc390cb5b4b59\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/49ce742eb8c2d66a93f93fd5a232b018695ebc1c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/49ce742eb8c2d66a93f93fd5a232b018695ebc1c"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}