)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ad7930bb96bdfedf157fefbeabab619ff3271fde","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"4bfaeab8_5a8b258b","updated":"2026-08-18 22:06:55.000000000","message":"Fungi suggested keeping those missing 7x ones, so let\u0027s add them before merge.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"80be7678349e74216bfb53ed31647c51d0800da8","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"eb351870_ad505226","updated":"2026-08-18 21:13:27.000000000","message":"Lots of negative feedback; but I did want to point out I\u0027m not commenting when the OSSNs render *better*, which is pretty frequently, too. \n\nOSSNs through OSSN-0020 checked against wiki. Continuing...","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"970f9ed8_ade501db","updated":"2026-08-18 22:33:21.000000000","message":"Need to add:\nhttps://wiki.openstack.org/wiki/OSSN/OSSN-0105\nhttps://wiki.openstack.org/wiki/OSSN/OSSN-0106\nhttps://wiki.openstack.org/wiki/OSSN/OSSN-0107","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ae2341e2cce7ce61ffedd3565243a0d9f1de84d5","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"503f18ed_fdc51d0d","updated":"2026-08-18 20:47:13.000000000","message":"One issue I\u0027ve noticed throughout: in the wiki, the discussion/recommended actions have more newlines and are significantly more readable.\n\n[dives back in to comparing OSSN-0010 through current in wiki]","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9246ebb297a2e4ba0b4233538cc81681c6884791","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"f14ecd97_7dea066b","updated":"2026-08-18 22:05:44.000000000","message":"Similarly: https://wiki.openstack.org/wiki/OSSN/OSSN-0075","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"c8e2455c_f0d80460","updated":"2026-08-18 21:30:25.000000000","message":"going to 40+ next","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9f55c7f038cf2b377ab4704838d316eb5fca1df3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"a2ef2e26_d17dcd71","updated":"2026-08-18 22:03:27.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0074 exists in wiki but not in repo. Unsure how to adjudicate that -- going to ask in IRC.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"83c403ac6dfd229e3cfead62aa3e6b73557d7840","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"a2cb1857_303c31a9","updated":"2026-08-18 22:06:10.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0076 as well","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"f5f85f52c16902e3ea503e179d6d8910f0d7b2dc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"f00a2547_c05f3975","updated":"2026-08-18 22:08:49.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0080 also needs to be added here.\n\nmoving on to 80+","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"63792446182eeafcc8e7ce7005acf6420ed5dd20","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"8931c735_f6b9eb6f","updated":"2026-08-18 22:15:49.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0088 needs to be added","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"34af632f735fff58ba062d15897a7c4613d540e4","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"944fa793_bf53bf56","updated":"2026-08-18 21:54:37.000000000","message":"moving on to 60+","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"cd8bdb47c879a615d7ab6f42d3694ebee9822fc6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"fafd8f25_9bbd809b","updated":"2026-08-24 19:25:15.000000000","message":"I\u0027m still reviewing this; but, i\u0027m okay with merging after seeing all the changes you folks have already done here - in the unlikely chance that i find anything wrong with this change, it can be a follow up. \n\n@m.sofiasarhiri@gmail.com - Great job! @jay@jvf.cc did okay too","commit_id":"fe54b8bf6eb5a80602afef8259510c721edc142f"}],"README.rst":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"cff3a8c4182351818ae9a07c9116d60a82fd8611","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The Security Notes are published by the OpenStack Security Project (OSSP) to"},{"line_number":18,"context_line":"advise users of security related issues. They are published at"},{"line_number":19,"context_line":"`Security Notes \u003chttps://security.openstack.org/security-notes\u003e`_ and the"},{"line_number":20,"context_line":"process is documented at"},{"line_number":21,"context_line":"`Security Note Process \u003chttps://wiki.openstack.org/wiki/Security/Security_Note_Process\u003e`_."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"f0bbfcd7_ed98e62f","line":19,"updated":"2026-08-13 18:35:05.000000000","message":"This is actually ending up at https://docs.openstack.org/security-guide/security-notes/ instead.","commit_id":"28e0430012236fd1ec699203c35128091671558d"},{"author":{"_account_id":39089,"name":"Sofia Sarhiri","display_name":"sarhiri","email":"m.sofiasarhiri@gmail.com","username":"sarhiri"},"change_message_id":"832484e0bc0548070dcd6cae5511fb0136af2a4f","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The Security Notes are published by the OpenStack Security Project (OSSP) to"},{"line_number":18,"context_line":"advise users of security related issues. They are published at"},{"line_number":19,"context_line":"`Security Notes \u003chttps://security.openstack.org/security-notes\u003e`_ and the"},{"line_number":20,"context_line":"process is documented at"},{"line_number":21,"context_line":"`Security Note Process \u003chttps://wiki.openstack.org/wiki/Security/Security_Note_Process\u003e`_."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"c60d9cfd_fde0fd78","line":19,"in_reply_to":"f0bbfcd7_ed98e62f","updated":"2026-08-17 19:01:35.000000000","message":"Hello! I made these changes and amended them to the commit :-). Thank you for your patience while I go through the Gerrit learning curve. And thank you for allowing me to be a part of this migration. Documentation ROCKS!!!!","commit_id":"28e0430012236fd1ec699203c35128091671558d"}],"security-notes/OSSN-0002.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":true,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"discussion: |"},{"line_number":12,"context_line":"  Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service."},{"line_number":13,"context_line":"  "},{"line_number":14,"context_line":"  In many cases Keystone will be deployed behind a load-balancer or proxy that can rate limit POST messages inbound to Keystone. Grizzly is protected against that through the sizelimit middleware."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":11,"id":"b907e1ab_91935d11","line":13,"updated":"2026-08-24 18:35:52.000000000","message":"nit: (throughout) we need to run a whitespace stripper on all these files","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"discussion: |"},{"line_number":12,"context_line":"  Keystone stores POST messages in memory before validation, concurrent submission of multiple large POST messages can cause the Keystone process to be killed due to memory exhaustion, resulting in a remote Denial of Service."},{"line_number":13,"context_line":"  "},{"line_number":14,"context_line":"  In many cases Keystone will be deployed behind a load-balancer or proxy that can rate limit POST messages inbound to Keystone. Grizzly is protected against that through the sizelimit middleware."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":11,"id":"eb6d060e_783321c6","line":13,"in_reply_to":"b907e1ab_91935d11","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"}],"security-notes/OSSN-0003.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":45,"context_line":"  - description: OpenStack Security ML"},{"line_number":46,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":47,"context_line":"  - description: OpenStack Security Group"},{"line_number":48,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"author: Robert Clark, HP"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ff1b8fd9_07b0e5f9","line":48,"updated":"2026-08-17 22:10:00.000000000","message":"The CVE reference from the original is missing. The original text has `CVE: CVE-2013-1977` in the Contacts/References section, but no CVE entry exists in the YAML `references.links`. This is a systematic issue — the conversion dropped CVE lines from all 14 OSSNs that had them. The affected files are: OSSN-0003 (CVE-2013-1977), OSSN-0004 (CVE-2013-4471), OSSN-0005 (CVE-2013-4354), OSSN-0012 (CVE-2014-0160), OSSN-0032 (CVE-2013-4222), OSSN-0038 (CVE-2013-2217), OSSN-0045 (CVE-2015-0204), OSSN-0054 (CVE-2015-5143), OSSN-0061 (CVE-2015-8234), OSSN-0062 (CVE-2015-7546), OSSN-0087 (CVE-2020-27781), OSSN-0091 (CVE-2022-44020), OSSN-0092 (CVE-2023-2088), OSSN-0093 (CVE-2024-29156). Each needs a `- description: CVE` / `url: CVE-YYYY-NNNNN` entry in references.links, matching the format used in other correctly-converted OSSNs like OSSN-0086.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"  - description: OpenStack Security ML"},{"line_number":46,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":47,"context_line":"  - description: OpenStack Security Group"},{"line_number":48,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"author: Robert Clark, HP"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"c7b04eb2_a1040914","line":48,"in_reply_to":"ff1b8fd9_07b0e5f9","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"919fd4e76336220b98e05065e32e8081281e700e","unresolved":true,"context_lines":[{"line_number":47,"context_line":"  - description: OpenStack Security Group"},{"line_number":48,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":49,"context_line":"  - description: CVE"},{"line_number":50,"context_line":"    url: CVE-2013-1977  "},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"author: Robert Clark, HP"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"a8cfd2a3_0df392be","line":50,"updated":"2026-08-20 17:01:44.000000000","message":"This will lead to a link being created to https://security.openstack.org/path/to/ossn/CVE-2013-1977\n\nThis needs to either be made NOT a url/link or the link needs to go to the public CVE database (e.g. https://nvd.nist.gov/vuln/detail/cve-2013-1977 )","commit_id":"8313983945eb67c522b6b39a2eca699251d6502a"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"  - description: OpenStack Security Group"},{"line_number":48,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":49,"context_line":"  - description: CVE"},{"line_number":50,"context_line":"    url: CVE-2013-1977  "},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"author: Robert Clark, HP"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"6b0febba_8396d2cc","line":50,"in_reply_to":"a8cfd2a3_0df392be","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"8313983945eb67c522b6b39a2eca699251d6502a"}],"security-notes/OSSN-0004.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ae2341e2cce7ce61ffedd3565243a0d9f1de84d5","unresolved":true,"context_lines":[{"line_number":50,"context_line":"  - description: OpenStack Security Group"},{"line_number":51,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"author: Nathan Kinder, Red Hat"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2932e3bb_3942581e","line":53,"updated":"2026-08-18 20:47:13.000000000","message":"a CVE identifier was dropped from this compared to https://wiki.openstack.org/wiki/OSSN/1237989","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":50,"context_line":"  - description: OpenStack Security Group"},{"line_number":51,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"author: Nathan Kinder, Red Hat"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7920a09e_10b63a13","line":53,"in_reply_to":"2932e3bb_3942581e","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0005.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ae2341e2cce7ce61ffedd3565243a0d9f1de84d5","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0005"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Glance allows sharing of images between projects without consumer project approval"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ec227c21_e3a41507","line":1,"updated":"2026-08-18 20:47:13.000000000","message":"missing CVE identifier from https://wiki.openstack.org/wiki/OSSN/1226078","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0005"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Glance allows sharing of images between projects without consumer project approval"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5012cd49_6e09d4d2","line":1,"in_reply_to":"ec227c21_e3a41507","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0007.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":32,"context_line":"  daemon only needs to listen for remote TCP connections on the interface"},{"line_number":33,"context_line":"  that is used for this communication. A firewall can be configured to"},{"line_number":34,"context_line":"  lock down access to the TCP port that the libvirt daemon listens on,"},{"line_number":35,"context_line":"  but this does not sufficiently protect access to the libvirt API."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"recommended-actions: |"},{"line_number":38,"context_line":"  If you are using the KVM hypervisor with libvirt on OpenStack Compute"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"51a10fe2_cdcfa914","line":35,"updated":"2026-08-17 22:10:00.000000000","message":"The discussion section drops a sentence from the original: \u0027Other processes on a remote OpenStack Compute node might have network access, but should not be authorized to remotely control the hypervisor on another OpenStack Compute node.\u0027 This explains why firewall-only protection is insufficient.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":true,"context_lines":[{"line_number":32,"context_line":"  daemon only needs to listen for remote TCP connections on the interface"},{"line_number":33,"context_line":"  that is used for this communication. A firewall can be configured to"},{"line_number":34,"context_line":"  lock down access to the TCP port that the libvirt daemon listens on,"},{"line_number":35,"context_line":"  but this does not sufficiently protect access to the libvirt API."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"recommended-actions: |"},{"line_number":38,"context_line":"  If you are using the KVM hypervisor with libvirt on OpenStack Compute"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d9252def_c409a193","line":35,"in_reply_to":"51a10fe2_cdcfa914","updated":"2026-08-24 18:35:52.000000000","message":"Done, but nit: wrapping here is weird","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":32,"context_line":"  daemon only needs to listen for remote TCP connections on the interface"},{"line_number":33,"context_line":"  that is used for this communication. A firewall can be configured to"},{"line_number":34,"context_line":"  lock down access to the TCP port that the libvirt daemon listens on,"},{"line_number":35,"context_line":"  but this does not sufficiently protect access to the libvirt API."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"recommended-actions: |"},{"line_number":38,"context_line":"  If you are using the KVM hypervisor with libvirt on OpenStack Compute"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"6ac692ec_76e40aee","line":35,"in_reply_to":"d9252def_c409a193","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"  When configuring the libvirt daemon for authentication, it is also"},{"line_number":101,"context_line":"  important to configure authorization to restrict remote access to your"},{"line_number":102,"context_line":"  OpenStack Compute nodes."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  In addition to requiring authentication for remote access to the libvirt"},{"line_number":105,"context_line":"  daemon on your OpenStack Compute nodes, it is also recommended to"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8c8e69b6_9672f6e8","line":102,"updated":"2026-08-17 22:10:00.000000000","message":"Several paragraphs of security guidance from the original Recommended Actions were dropped during conversion. The original (lines 128-208) contains actionable content that is absent from the YAML: (1) Authorization examples — what happens without proper authorization (any signed X.509 cert or any valid Kerberos TGT gets access). (2) Ephemeral port security — migration uses unauthenticated/unencrypted ephemeral ports by default. (3) Live block migration caveat — tunneling doesn\u0027t apply to live block migration, which only works over ephemeral ports. (4) Specific port numbers operators need for firewall rules: 16514 (TLS), 16509 (TCP), 49152-49215 (ephemeral migration), 5900-49151 (live block migration). (5) Note about libvirt versions \u003c 1.1.4 not supporting interface restriction for ephemeral ports. This is directly actionable security guidance — operators need the port numbers and the block migration caveat to correctly configure their firewalls.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"  When configuring the libvirt daemon for authentication, it is also"},{"line_number":101,"context_line":"  important to configure authorization to restrict remote access to your"},{"line_number":102,"context_line":"  OpenStack Compute nodes."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  In addition to requiring authentication for remote access to the libvirt"},{"line_number":105,"context_line":"  daemon on your OpenStack Compute nodes, it is also recommended to"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"779df34f_7c396e59","line":102,"in_reply_to":"8c8e69b6_9672f6e8","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0008.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ae2341e2cce7ce61ffedd3565243a0d9f1de84d5","unresolved":true,"context_lines":[{"line_number":37,"context_line":"  - description: OpenStack Security Group"},{"line_number":38,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"author: Sriram Subramanian, CloudDon"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9ddfb9e2_6b2cea53","line":40,"updated":"2026-08-18 20:47:13.000000000","message":"we dropped an author here compared to https://wiki.openstack.org/wiki/OSSN/OSSN-0008","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  - description: OpenStack Security Group"},{"line_number":38,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"author: Sriram Subramanian, CloudDon"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"11cedb89_16427a42","line":40,"in_reply_to":"9ddfb9e2_6b2cea53","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0012.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"80be7678349e74216bfb53ed31647c51d0800da8","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0012"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: OpenSSL Heartbleed vulnerability can lead to OpenStack compromise"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d46298e8_4fdad65b","line":1,"updated":"2026-08-18 21:13:27.000000000","message":"Missing an author and a CVE identifier when compared to https://wiki.openstack.org/wiki/OSSN/OSSN-0012","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0012"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: OpenSSL Heartbleed vulnerability can lead to OpenStack compromise"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"02df4358_6b73afd4","line":1,"in_reply_to":"d46298e8_4fdad65b","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0013.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"80be7678349e74216bfb53ed31647c51d0800da8","unresolved":true,"context_lines":[{"line_number":93,"context_line":"  - description: OpenStack Security Group"},{"line_number":94,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"author: Nathan Kinder, Red Hat"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"33576198_7f796f17","line":96,"updated":"2026-08-18 21:13:27.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0013 he is not listed here?","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":true,"context_lines":[{"line_number":93,"context_line":"  - description: OpenStack Security Group"},{"line_number":94,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"author: Nathan Kinder, Red Hat"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e3d0970a_5e08b1b8","line":96,"in_reply_to":"33576198_7f796f17","updated":"2026-08-24 18:35:52.000000000","message":"This still needs to be addressed","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  - description: OpenStack Security Group"},{"line_number":94,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"author: Nathan Kinder, Red Hat"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"30af59b5_48e37586","line":96,"in_reply_to":"e3d0970a_5e08b1b8","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0017.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"80be7678349e74216bfb53ed31647c51d0800da8","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    url: http://www.pabloendres.com/horizon-and-cookies/#comment-115"},{"line_number":71,"context_line":"  - description: Link"},{"line_number":72,"context_line":"    url: https://docs.djangoproject.com/en/1.6/ref/settings/"},{"line_number":73,"context_line":"  - description: Link"},{"line_number":74,"context_line":"    url: https://docs.djangoproject.com/en/1.6/topics/http/sessions/#configuring-sessions"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"author: Travis McPeak, Symantec"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d27ce8e5_f6759725","line":73,"updated":"2026-08-18 21:13:27.000000000","message":"These need proper descriptions; they are just blue \"Link\" links in rendered version.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    url: http://www.pabloendres.com/horizon-and-cookies/#comment-115"},{"line_number":71,"context_line":"  - description: Link"},{"line_number":72,"context_line":"    url: https://docs.djangoproject.com/en/1.6/ref/settings/"},{"line_number":73,"context_line":"  - description: Link"},{"line_number":74,"context_line":"    url: https://docs.djangoproject.com/en/1.6/topics/http/sessions/#configuring-sessions"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"author: Travis McPeak, Symantec"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"4f74b815_47eb790a","line":73,"in_reply_to":"d27ce8e5_f6759725","updated":"2026-08-24 18:35:52.000000000","message":"This renders fine. Doesn\u0027t matter.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0020.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"80be7678349e74216bfb53ed31647c51d0800da8","unresolved":true,"context_lines":[{"line_number":33,"context_line":"  version of Neutron."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"references:"},{"line_number":36,"context_line":"  links:"},{"line_number":37,"context_line":"  - description: This OSSN"},{"line_number":38,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0020"},{"line_number":39,"context_line":"  - description: Original LaunchPad Bug"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"05a6d59c_ad3d2da4","line":36,"updated":"2026-08-18 21:13:27.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0020 lists an author from symantec","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":33,"context_line":"  version of Neutron."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"references:"},{"line_number":36,"context_line":"  links:"},{"line_number":37,"context_line":"  - description: This OSSN"},{"line_number":38,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0020"},{"line_number":39,"context_line":"  - description: Original LaunchPad Bug"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ff9ce09b_d2cb0887","line":36,"in_reply_to":"05a6d59c_ad3d2da4","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0027.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":72,"context_line":"    url: http://ettercap.github.io/ettercap"},{"line_number":73,"context_line":"  - description: ARP Poisoning"},{"line_number":74,"context_line":"    url: http://en.wikipedia.org/wiki/ARP_spoofing"},{"line_number":75,"context_line":"  - description: Link"},{"line_number":76,"context_line":"    url: http://www.watchguard.com/infocenter/editorial/135324.asp"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"author: Tim Kelsey, HPE"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e9405661_d6d28f45","line":75,"updated":"2026-08-18 21:30:25.000000000","message":"needs a description","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":72,"context_line":"    url: http://ettercap.github.io/ettercap"},{"line_number":73,"context_line":"  - description: ARP Poisoning"},{"line_number":74,"context_line":"    url: http://en.wikipedia.org/wiki/ARP_spoofing"},{"line_number":75,"context_line":"  - description: Link"},{"line_number":76,"context_line":"    url: http://www.watchguard.com/infocenter/editorial/135324.asp"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"author: Tim Kelsey, HPE"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"574f3765_9e80a23a","line":75,"in_reply_to":"e9405661_d6d28f45","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0030.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":71,"context_line":"  - description: Link"},{"line_number":72,"context_line":"    url: http://web.nvd.nist.gov/view/vuln/detail?vulnId\u003dCVE-2014-6271"},{"line_number":73,"context_line":"  - description: Link"},{"line_number":74,"context_line":"    url: http://web.nvd.nist.gov/view/vuln/detail?vulnId\u003dCVE-2014-7169"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"author: Tim Kelsey, HP"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f6a3269d_36137bc6","line":73,"updated":"2026-08-18 21:30:25.000000000","message":"These need descriptions. -- just \"CVE-yyyy-xxxx\" is sufficient for text","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":71,"context_line":"  - description: Link"},{"line_number":72,"context_line":"    url: http://web.nvd.nist.gov/view/vuln/detail?vulnId\u003dCVE-2014-6271"},{"line_number":73,"context_line":"  - description: Link"},{"line_number":74,"context_line":"    url: http://web.nvd.nist.gov/view/vuln/detail?vulnId\u003dCVE-2014-7169"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"author: Tim Kelsey, HP"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"6b85e6c4_3ac821f5","line":73,"in_reply_to":"f6a3269d_36137bc6","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0032.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0032"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Disabling a tenant does not disable a user token"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"eb01303e_ed8af1dc","line":1,"updated":"2026-08-18 21:30:25.000000000","message":"this is missing the CVE that\u0027s in https://wiki.openstack.org/wiki/OSSN/OSSN-0032","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0032"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Disabling a tenant does not disable a user token"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b12f9466_f2c40e55","line":1,"in_reply_to":"eb01303e_ed8af1dc","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0033.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"  Later versions of Python, namedly 2.7.9 and 3.4.3, do perform proper"},{"line_number":34,"context_line":"  validation in establishing connections. So this OSSN only applies to"},{"line_number":35,"context_line":"  environments running older versions of Python."},{"line_number":36,"context_line":"  "},{"line_number":37,"context_line":"recommended-actions: \u003e"},{"line_number":38,"context_line":"  Some projects have updated their code to be more secure, others have"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"81c66045_114ad5e4","line":35,"updated":"2026-08-18 21:30:25.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0033\n\nweirdly enough, these sentences are not in the wiki version\n\nI suspect we have cases (this + the CVEs?) where the txt and the wiki have drifted. I\u0027m glad I\u0027m checking the wiki pages, we\u0027ll end up with one corpus of valid data 😅","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"  Later versions of Python, namedly 2.7.9 and 3.4.3, do perform proper"},{"line_number":34,"context_line":"  validation in establishing connections. So this OSSN only applies to"},{"line_number":35,"context_line":"  environments running older versions of Python."},{"line_number":36,"context_line":"  "},{"line_number":37,"context_line":"recommended-actions: \u003e"},{"line_number":38,"context_line":"  Some projects have updated their code to be more secure, others have"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b19b7e62_aaec7fb9","line":35,"in_reply_to":"81c66045_114ad5e4","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0035.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":49,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":50,"context_line":"  - description: OpenStack Security Group"},{"line_number":51,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":52,"context_line":"  - description: Link"},{"line_number":53,"context_line":"    url: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"author: Robert Clark, HP"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"4267d007_fc0e620e","line":52,"updated":"2026-08-18 21:30:25.000000000","message":"needs a description","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":50,"context_line":"  - description: OpenStack Security Group"},{"line_number":51,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":52,"context_line":"  - description: Link"},{"line_number":53,"context_line":"    url: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"author: Robert Clark, HP"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d666a508_5ecb90fb","line":52,"in_reply_to":"4267d007_fc0e620e","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0037.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":38,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":39,"context_line":"  - description: OpenStack Security Group"},{"line_number":40,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":41,"context_line":"  - description: Link"},{"line_number":42,"context_line":"    url: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/"},{"line_number":43,"context_line":"  - description: More info on BREACH"},{"line_number":44,"context_line":"    url: http://breachattack.com/"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"c0aa46fb_a235c2a9","line":41,"updated":"2026-08-18 21:30:25.000000000","message":"needs description","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    url: openstack-security@lists.openstack.org"},{"line_number":39,"context_line":"  - description: OpenStack Security Group"},{"line_number":40,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":41,"context_line":"  - description: Link"},{"line_number":42,"context_line":"    url: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/"},{"line_number":43,"context_line":"  - description: More info on BREACH"},{"line_number":44,"context_line":"    url: http://breachattack.com/"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f2bca022_fb66ef9f","line":41,"in_reply_to":"c0aa46fb_a235c2a9","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0038.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0038"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Suds client subject to cache poisoning by local attacker"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"6c6408d0_4fc3d6a3","line":1,"updated":"2026-08-18 21:30:25.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0038 has a CVE that\u0027s not in here","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0038"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Suds client subject to cache poisoning by local attacker"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"51314261_33d833af","line":1,"in_reply_to":"6c6408d0_4fc3d6a3","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":true,"context_lines":[{"line_number":41,"context_line":"  - description: Suds"},{"line_number":42,"context_line":"    url: https://pypi.python.org/pypi/suds"},{"line_number":43,"context_line":"  - description: CVE"},{"line_number":44,"context_line":"    url: https://access.redhat.com/security/cve/CVE-2015-5160"},{"line_number":45,"context_line":"author: Tim Kelsey, HPE"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":11,"id":"50620413_e7f96387","line":44,"updated":"2026-08-24 18:35:52.000000000","message":"nit: This is inconsistent with the other CVEs which have been linked to the NIST CVE DB.","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  - description: Suds"},{"line_number":42,"context_line":"    url: https://pypi.python.org/pypi/suds"},{"line_number":43,"context_line":"  - description: CVE"},{"line_number":44,"context_line":"    url: https://access.redhat.com/security/cve/CVE-2015-5160"},{"line_number":45,"context_line":"author: Tim Kelsey, HPE"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":11,"id":"5555d708_5446b222","line":44,"in_reply_to":"50620413_e7f96387","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"}],"security-notes/OSSN-0039.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"120750a0f6f154404d6f8123f08ad5154f6eca68","unresolved":true,"context_lines":[{"line_number":19,"context_line":"discussion: |"},{"line_number":20,"context_line":"  The POODLE attack was first announced on 14 Oct 2014. For a deeper"},{"line_number":21,"context_line":"  technical discussion on POODLE, we refer you to the security advisory at"},{"line_number":22,"context_line":"  openssl.org and Daniel Franke\u0027s write-up. POODLE affects any SSL/TLS"},{"line_number":23,"context_line":"  connection that can be downgraded to SSLv3. This requires both the"},{"line_number":24,"context_line":"  client and the server to support SSLv3. Due to the way the protocol"},{"line_number":25,"context_line":"  negotiations work, an attacker positioned on the network between the"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"518354a6_dafe55c7","line":22,"updated":"2026-08-18 21:30:25.000000000","message":"This is rendering not so great. Can we slightly modify it to make sense without referencing nonexistent references:\n\n\"The POODLE attach was first announced on 14 Oct 2014. For a deeper technical discussion on POODLE, please see the references at the bottom of the page\"\n\nand improve the URL references at the bottom to have descriptions that make it obvious what the references are?","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":19,"context_line":"discussion: |"},{"line_number":20,"context_line":"  The POODLE attack was first announced on 14 Oct 2014. For a deeper"},{"line_number":21,"context_line":"  technical discussion on POODLE, we refer you to the security advisory at"},{"line_number":22,"context_line":"  openssl.org and Daniel Franke\u0027s write-up. POODLE affects any SSL/TLS"},{"line_number":23,"context_line":"  connection that can be downgraded to SSLv3. This requires both the"},{"line_number":24,"context_line":"  client and the server to support SSLv3. Due to the way the protocol"},{"line_number":25,"context_line":"  negotiations work, an attacker positioned on the network between the"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2467fb7e_164be042","line":22,"in_reply_to":"518354a6_dafe55c7","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0043.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"34af632f735fff58ba062d15897a7c4613d540e4","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0043"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: glibc \u0027GHOST\u0027 vulnerability can allow remote code execution"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8464ec12_403f06c4","line":1,"updated":"2026-08-18 21:54:37.000000000","message":"CVE in the wiki but not here https://wiki.openstack.org/wiki/OSSN/OSSN-0043","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0043"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: glibc \u0027GHOST\u0027 vulnerability can allow remote code execution"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"c8159307_8a360928","line":1,"in_reply_to":"8464ec12_403f06c4","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0054.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"34af632f735fff58ba062d15897a7c4613d540e4","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0054"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Potential Denial of Service in Horizon login"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"4366ddd3_c803a16c","line":1,"updated":"2026-08-18 21:54:37.000000000","message":"django CVE got dropped compared to https://wiki.openstack.org/wiki/OSSN/OSSN-0054","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0054"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Potential Denial of Service in Horizon login"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e5362240_9c032078","line":1,"in_reply_to":"4366ddd3_c803a16c","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0059.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"34af632f735fff58ba062d15897a7c4613d540e4","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":43,"context_line":"  - description: Link"},{"line_number":44,"context_line":"    url: http://lists.openstack.org/pipermail/openstack-dev/2015-June/067766.html"},{"line_number":45,"context_line":"  - description: Link"},{"line_number":46,"context_line":"    url: https://review.openstack.org/#/c/194592"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"author: Michael Xin, Rackspace"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5cdf2e7d_12df25c3","line":45,"updated":"2026-08-18 21:54:37.000000000","message":"needs a valid description, also above","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":43,"context_line":"  - description: Link"},{"line_number":44,"context_line":"    url: http://lists.openstack.org/pipermail/openstack-dev/2015-June/067766.html"},{"line_number":45,"context_line":"  - description: Link"},{"line_number":46,"context_line":"    url: https://review.openstack.org/#/c/194592"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"author: Michael Xin, Rackspace"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"32902b49_0ce1c733","line":45,"in_reply_to":"5cdf2e7d_12df25c3","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0061.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9f55c7f038cf2b377ab4704838d316eb5fca1df3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0061"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Glance image signature uses an insecure hash algorithm (MD5)"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7481fe6c_9fe87ea6","line":1,"updated":"2026-08-18 22:03:27.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0061 lists a CVE that\u0027s missing here","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0061"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Glance image signature uses an insecure hash algorithm (MD5)"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"bfcc05cd_9ecac94c","line":1,"in_reply_to":"7481fe6c_9fe87ea6","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0062.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9f55c7f038cf2b377ab4704838d316eb5fca1df3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0062"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Potential reuse of revoked Identity tokens"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5992eec1_21c64a1f","line":1,"updated":"2026-08-18 22:03:27.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0062 CVE from here is missing","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0062"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Potential reuse of revoked Identity tokens"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"c1e55936_79a2d782","line":1,"in_reply_to":"5992eec1_21c64a1f","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0066.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9f55c7f038cf2b377ab4704838d316eb5fca1df3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0066"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: MongoDB guest instance allows any user to connect"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2f484f64_ef09c64a","line":1,"updated":"2026-08-18 22:03:27.000000000","message":"the wiki version of this has an errata not reflected here -\u003e https://wiki.openstack.org/wiki/OSSN/OSSN-0066","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0066"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: MongoDB guest instance allows any user to connect"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"fe35866b_22bab199","line":1,"in_reply_to":"2f484f64_ef09c64a","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0068.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9f55c7f038cf2b377ab4704838d316eb5fca1df3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0068"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Repeated token revocation requests can lead to service degradation or disruption"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e61594ae_3bedd02b","line":1,"updated":"2026-08-18 22:03:27.000000000","message":"There\u0027s a large amount of content here -- the entire section under \"Other possible solutions\" missing that exist in https://wiki.openstack.org/wiki/OSSN/OSSN-0068","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0068"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Repeated token revocation requests can lead to service degradation or disruption"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"afb0e144_b415c0c3","line":1,"in_reply_to":"e61594ae_3bedd02b","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0079.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"f5f85f52c16902e3ea503e179d6d8910f0d7b2dc","unresolved":true,"context_lines":[{"line_number":22,"context_line":"references:"},{"line_number":23,"context_line":"  links:"},{"line_number":24,"context_line":"  - description: Link"},{"line_number":25,"context_line":"    url: https://access.redhat.com/security/cve/CVE-2015-5160"},{"line_number":26,"context_line":"  - description: This OSSN"},{"line_number":27,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0079"},{"line_number":28,"context_line":"  - description: Original LaunchPad Bug"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f251df92_87d30206","line":25,"updated":"2026-08-18 22:08:49.000000000","message":"I would say \"fix this description\", but given it\u0027s just linking to a CVE, we can just notate the CVE as usual with or without the link","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":22,"context_line":"references:"},{"line_number":23,"context_line":"  links:"},{"line_number":24,"context_line":"  - description: Link"},{"line_number":25,"context_line":"    url: https://access.redhat.com/security/cve/CVE-2015-5160"},{"line_number":26,"context_line":"  - description: This OSSN"},{"line_number":27,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0079"},{"line_number":28,"context_line":"  - description: Original LaunchPad Bug"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"59bf10f8_d38fef40","line":25,"in_reply_to":"f251df92_87d30206","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0087.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":73,"context_line":"  service (manila). With an upgraded ceph, when manila users attempt to"},{"line_number":74,"context_line":"  provide share access to a ``cephx`` username that they cannot use, the"},{"line_number":75,"context_line":"  access rule\u0027s ``state`` attribute is set to ``error`` because this"},{"line_number":76,"context_line":"  operation is no longer permitted."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"references:"},{"line_number":79,"context_line":"  links:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"43947936_83b157f8","line":76,"updated":"2026-08-17 22:10:00.000000000","message":"The entire Patches section from the original is missing. The original text (lines 92-103) contains the actual Ceph fix commit URLs that operators need to remediate this vulnerability: Ceph Octopus (https://github.com/ceph/ceph/commit/1b8a634fdcd94dfb3ba650793fb1b6d09af65e05), Ceph Nautilus (https://github.com/ceph/ceph/commit/7e3e4e73783a98bb07ab399438eb3aab41a6fc8b), Ceph Luminous (https://github.com/ceph/ceph/commit/956ceb853a58f6b6847b31fac34f2f0228a70579). It also includes the fixed release versions (Nautilus 14.2.16, Octopus 15.2.8) and a note that Luminous/Mimic patches were courtesy fixes for EOL releases. This is the most actionable part of the security note and needs to be preserved — either inline in `recommended-actions` or as reference links.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"63792446182eeafcc8e7ce7005acf6420ed5dd20","unresolved":true,"context_lines":[{"line_number":73,"context_line":"  service (manila). With an upgraded ceph, when manila users attempt to"},{"line_number":74,"context_line":"  provide share access to a ``cephx`` username that they cannot use, the"},{"line_number":75,"context_line":"  access rule\u0027s ``state`` attribute is set to ``error`` because this"},{"line_number":76,"context_line":"  operation is no longer permitted."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"references:"},{"line_number":79,"context_line":"  links:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9f6d3130_425ce1ef","line":76,"in_reply_to":"43947936_83b157f8","updated":"2026-08-18 22:15:49.000000000","message":"note: please make sure we use https://wiki.openstack.org/wiki/OSSN/OSSN-0087 to fetch this info from, I think it\u0027s slightly newer","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  service (manila). With an upgraded ceph, when manila users attempt to"},{"line_number":74,"context_line":"  provide share access to a ``cephx`` username that they cannot use, the"},{"line_number":75,"context_line":"  access rule\u0027s ``state`` attribute is set to ``error`` because this"},{"line_number":76,"context_line":"  operation is no longer permitted."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"references:"},{"line_number":79,"context_line":"  links:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7332d171_a3ed551e","line":76,"in_reply_to":"9f6d3130_425ce1ef","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":85,"context_line":"    url: tag on openstack-discuss@lists.openstack.org"},{"line_number":86,"context_line":"  - description: OpenStack Security Project"},{"line_number":87,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"92cfe639_8f8b4b69","line":88,"updated":"2026-08-17 22:10:00.000000000","message":"The `author` and `credits` fields are entirely missing from the YAML. The original has: Author: Pacha Ravi, Goutham \u003cgouthamr@redhat.com\u003e (Red Hat), Credits: Garbutt, John \u003cjohn@johngarbutt.com\u003e (StackHPC) and Babel, Jahson \u003cjahson.babel@cc.in2p3.fr\u003e (Centre de Calcul de l\u0027IN2P3). Both fields need to be added.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    url: tag on openstack-discuss@lists.openstack.org"},{"line_number":86,"context_line":"  - description: OpenStack Security Project"},{"line_number":87,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b92adb38_34ad6ad0","line":88,"in_reply_to":"89d0a898_6d1c0e05","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"63792446182eeafcc8e7ce7005acf6420ed5dd20","unresolved":true,"context_lines":[{"line_number":85,"context_line":"    url: tag on openstack-discuss@lists.openstack.org"},{"line_number":86,"context_line":"  - description: OpenStack Security Project"},{"line_number":87,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"89d0a898_6d1c0e05","line":88,"in_reply_to":"92cfe639_8f8b4b69","updated":"2026-08-18 22:15:49.000000000","message":"++","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0089.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":51,"context_line":"     the ``libvirt`` section::"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"       live_migration_scheme \u003d tls"},{"line_number":54,"context_line":"       "},{"line_number":55,"context_line":"references:"},{"line_number":56,"context_line":"  links:"},{"line_number":57,"context_line":"  - description: This OSSN"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"80e6f290_0d19b010","line":54,"updated":"2026-08-17 22:10:00.000000000","message":"The Patches section from the original is missing. The original text (lines 52-62) contains context about the guide update and 5 review links for the fix across releases: Master/Wallaby (+/781030), Victoria (+/781211), Ussuri (+/782126), Train (+/782430), Stein (+/783199). These are documentation fix patches (not code fixes), but still useful references for operators verifying their deployment was corrected. They should be preserved in `recommended-actions` or as reference links.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":51,"context_line":"     the ``libvirt`` section::"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"       live_migration_scheme \u003d tls"},{"line_number":54,"context_line":"       "},{"line_number":55,"context_line":"references:"},{"line_number":56,"context_line":"  links:"},{"line_number":57,"context_line":"  - description: This OSSN"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"bdd62d8a_48c5cd15","line":54,"in_reply_to":"80e6f290_0d19b010","updated":"2026-08-18 22:33:21.000000000","message":"++ again let\u0027s make sure to grab it from https://wiki.openstack.org/wiki/OSSN/OSSN-0089","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":51,"context_line":"     the ``libvirt`` section::"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"       live_migration_scheme \u003d tls"},{"line_number":54,"context_line":"       "},{"line_number":55,"context_line":"references:"},{"line_number":56,"context_line":"  links:"},{"line_number":57,"context_line":"  - description: This OSSN"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"564d1b88_bc20e80a","line":54,"in_reply_to":"bdd62d8a_48c5cd15","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0090.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":66,"context_line":"  will efficiently clone a volume created from an image directly in the"},{"line_number":67,"context_line":"  backend without checksumming the image data. Again, this is done"},{"line_number":68,"context_line":"  intentionally in order to optimize resources, but it is important to be"},{"line_number":69,"context_line":"  aware of the security tradeoff being made by this configuration."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  OSSN-0065 suggested that the attack vector of substituting image data by"},{"line_number":72,"context_line":"  modifying the image locations could be addressed by using policies, but"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"cf4c3bc0_a370fc5e","line":69,"updated":"2026-08-17 22:10:00.000000000","message":"The original discussion (lines 87-88) contains: \u0027Thus, if the backend store is itself compromised and image data is replaced directly in the backend, the substitution will *not* be detected.\u0027 This key security warning about backend compromise was dropped from the YAML.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":66,"context_line":"  will efficiently clone a volume created from an image directly in the"},{"line_number":67,"context_line":"  backend without checksumming the image data. Again, this is done"},{"line_number":68,"context_line":"  intentionally in order to optimize resources, but it is important to be"},{"line_number":69,"context_line":"  aware of the security tradeoff being made by this configuration."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"  OSSN-0065 suggested that the attack vector of substituting image data by"},{"line_number":72,"context_line":"  modifying the image locations could be addressed by using policies, but"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"58fa0fee_4c21e943","line":69,"in_reply_to":"cf4c3bc0_a370fc5e","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":115,"context_line":"  unknown exploits, so it should likewise only be enabled on an internal-"},{"line_number":116,"context_line":"  only-facing glance-api."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"references:"},{"line_number":119,"context_line":"  links:"},{"line_number":120,"context_line":"  - description: This OSSN"},{"line_number":121,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0090"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7c0dcf98_7f6aa21d","line":118,"updated":"2026-08-17 22:10:00.000000000","message":"The original\u0027s Notes/References section (lines 124-135) with 6 technical footnotes was entirely dropped. Most critically, footnote [1] contains the specific config directives operators need to implement the dual glance-api deployment: \u0027Nova and Ironic use endpoint_override in the [glance] section of the appropriate configuration file; Cinder uses glance_api_servers in the [DEFAULT] section of cinder.conf.\u0027 Without this, operators reading the OSSN don\u0027t know which config options to set. Also dropped: the Glance API schema URL [0], the OSSN-0065 cross-reference URL [2], multihash history [3], Rocky release notes URL [4], and the image-data-download API URL [5]. These should be preserved either inline in the discussion (where they were originally referenced as [0]-[5]) or as reference links.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":115,"context_line":"  unknown exploits, so it should likewise only be enabled on an internal-"},{"line_number":116,"context_line":"  only-facing glance-api."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"references:"},{"line_number":119,"context_line":"  links:"},{"line_number":120,"context_line":"  - description: This OSSN"},{"line_number":121,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0090"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"da54734e_6499f86e","line":118,"in_reply_to":"7c0dcf98_7f6aa21d","updated":"2026-08-18 22:33:21.000000000","message":"yep, that needs to be added from https://wiki.openstack.org/wiki/OSSN/OSSN-0090","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":115,"context_line":"  unknown exploits, so it should likewise only be enabled on an internal-"},{"line_number":116,"context_line":"  only-facing glance-api."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"references:"},{"line_number":119,"context_line":"  links:"},{"line_number":120,"context_line":"  - description: This OSSN"},{"line_number":121,"context_line":"    url: https://wiki.openstack.org/wiki/OSSN/OSSN-0090"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ae139274_1e62f512","line":118,"in_reply_to":"da54734e_6499f86e","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":true,"context_lines":[{"line_number":52,"context_line":"  uploaded to Glance, but instead a snapshot is created directly in the"},{"line_number":53,"context_line":"  backend and Nova creates a Glance image record with \"size\" 0 and an"},{"line_number":54,"context_line":"  empty ``os_hash_value``, making it impossible to compare the hash of"},{"line_number":55,"context_line":"  downloaded image data to the value maintained by Glance.Thus, if the "},{"line_number":56,"context_line":"  backend store is itself compromised and image data is"},{"line_number":57,"context_line":"  replaced directly in the backend, the substitution will *not* be"},{"line_number":58,"context_line":"  detected."}],"source_content_type":"text/x-yaml","patch_set":11,"id":"6763b1c8_9ec8c0f4","line":55,"updated":"2026-08-24 18:35:52.000000000","message":"nit: Glance.Thus (needs a space)","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"bff598a27f28603defe4deb4298649dae1a9e6d8","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  uploaded to Glance, but instead a snapshot is created directly in the"},{"line_number":53,"context_line":"  backend and Nova creates a Glance image record with \"size\" 0 and an"},{"line_number":54,"context_line":"  empty ``os_hash_value``, making it impossible to compare the hash of"},{"line_number":55,"context_line":"  downloaded image data to the value maintained by Glance.Thus, if the "},{"line_number":56,"context_line":"  backend store is itself compromised and image data is"},{"line_number":57,"context_line":"  replaced directly in the backend, the substitution will *not* be"},{"line_number":58,"context_line":"  detected."}],"source_content_type":"text/x-yaml","patch_set":11,"id":"2c1c0560_446d168b","line":55,"in_reply_to":"6763b1c8_9ec8c0f4","updated":"2026-08-24 18:41:17.000000000","message":"Done","commit_id":"cffddc4fc5bdff6ee942f7f65b5b1136e348cba7"}],"security-notes/OSSN-0091.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":7,"context_line":"  OpenStack software or services intended for production use."},{"line_number":8,"context_line":"  "},{"line_number":9,"context_line":"summary: \u003e"},{"line_number":10,"context_line":"  When deploying VirtualBMC or Sushy-Tools in an unsupported, production-"},{"line_number":11,"context_line":"  like configuration, it can remove secret data, including VNC passwords,"},{"line_number":12,"context_line":"  from a libvirt domain permanently. Operators impacted by this"},{"line_number":13,"context_line":"  vulnerability must reconfigure any secret data, including VNC passwords,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8686b158_1cebab2b","line":10,"updated":"2026-08-18 22:33:21.000000000","message":"missing CVE from https://wiki.openstack.org/wiki/OSSN/OSSN-0091\n\nalso wrapping on this hyphen is adding a space in the render","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  OpenStack software or services intended for production use."},{"line_number":8,"context_line":"  "},{"line_number":9,"context_line":"summary: \u003e"},{"line_number":10,"context_line":"  When deploying VirtualBMC or Sushy-Tools in an unsupported, production-"},{"line_number":11,"context_line":"  like configuration, it can remove secret data, including VNC passwords,"},{"line_number":12,"context_line":"  from a libvirt domain permanently. Operators impacted by this"},{"line_number":13,"context_line":"  vulnerability must reconfigure any secret data, including VNC passwords,"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"dbc7b562_4d54538f","line":10,"in_reply_to":"8686b158_1cebab2b","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0092.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":116,"context_line":"    url: openstack-discuss@lists.openstack.org"},{"line_number":117,"context_line":"  - description: OpenStack Security Project"},{"line_number":118,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7cef60a0_6c7833b3","line":119,"updated":"2026-08-17 22:10:00.000000000","message":"The `author` and `credits` fields are completely missing. The original has 5 authors: Brian Rosmaita (Red Hat), Dan Smith (Red Hat), Gorka Eguileor (Red Hat), Jeremy Stanley (OpenInfra Foundation), Nick Tait (Red Hat), and 2 credits: Jan Wasilewski (Atman), Gorka Eguileor (Red Hat). Both fields need to be added.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":116,"context_line":"    url: openstack-discuss@lists.openstack.org"},{"line_number":117,"context_line":"  - description: OpenStack Security Project"},{"line_number":118,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"bde44c50_54add235","line":119,"in_reply_to":"7cef60a0_6c7833b3","updated":"2026-08-18 22:33:21.000000000","message":"https://wiki.openstack.org/wiki/OSSN/OSSN-0092 ++","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    url: openstack-discuss@lists.openstack.org"},{"line_number":117,"context_line":"  - description: OpenStack Security Project"},{"line_number":118,"context_line":"    url: https://launchpad.net/~openstack-ossg"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ae840abc_c6aafad1","line":119,"in_reply_to":"bde44c50_54add235","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0093.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0093"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Unsafe Environment Handling in MuranoPL"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2920f6d9_cc6c2184","line":1,"updated":"2026-08-18 22:33:21.000000000","message":"CVE listed https://wiki.openstack.org/wiki/OSSN/OSSN-0093 is missing","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0093"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Unsafe Environment Handling in MuranoPL"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ee54d9cc_0a0127e6","line":1,"in_reply_to":"2920f6d9_cc6c2184","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0094.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":104,"context_line":"  - description: Watcher patch stable/2024.1"},{"line_number":105,"context_line":"    url: https://review.opendev.org/c/openstack/watcher/+/957774"},{"line_number":106,"context_line":"  - description: Nova patch stable/2024.1"},{"line_number":107,"context_line":"    url: https://review.opendev.org/c/openstack/nova/+/957764"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"author: Sean Mooney, Jay Faulkner"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"34ad318d_01b89c72","line":107,"updated":"2026-08-18 22:33:21.000000000","message":"The \"X Patch YYYY.Z\" links are all duplicates of stuff above; I\u0027d remove them.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  - description: Watcher patch stable/2024.1"},{"line_number":105,"context_line":"    url: https://review.opendev.org/c/openstack/watcher/+/957774"},{"line_number":106,"context_line":"  - description: Nova patch stable/2024.1"},{"line_number":107,"context_line":"    url: https://review.opendev.org/c/openstack/nova/+/957764"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"author: Sean Mooney, Jay Faulkner"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"fc26d647_8a5c091a","line":107,"in_reply_to":"34ad318d_01b89c72","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"adb466bc56c889a5f57a783d8816e027e6ae59d0","unresolved":true,"context_lines":[{"line_number":106,"context_line":"  - description: Nova patch stable/2024.1"},{"line_number":107,"context_line":"    url: https://review.opendev.org/c/openstack/nova/+/957764"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"author: Sean Mooney, Jay Faulkner"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f61cbcc5_8276b7fd","line":109,"updated":"2026-08-17 22:10:00.000000000","message":"The author field has `Sean Mooney, Jay Faulkner` but the original includes their email addresses: `Sean Mooney \u003csmooney@redhat.com\u003e, Jay Faulkner \u003cjay@jvf.cc\u003e`. The email addresses were stripped during conversion. This is minor since the template.yaml examples don\u0027t include emails, but noting it for completeness.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":106,"context_line":"  - description: Nova patch stable/2024.1"},{"line_number":107,"context_line":"    url: https://review.opendev.org/c/openstack/nova/+/957764"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"author: Sean Mooney, Jay Faulkner"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f4e5e454_5fee1d3c","line":109,"in_reply_to":"f61cbcc5_8276b7fd","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0095.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":46,"context_line":"  - description: OpenStack Security"},{"line_number":47,"context_line":"    url: https://security.openstack.org/"},{"line_number":48,"context_line":"  - description: CVE"},{"line_number":49,"context_line":"    url: none"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"author: Goutham Pacha Ravi, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"84d89647_09b834a1","line":49,"updated":"2026-08-18 22:33:21.000000000","message":"Not a valid URL","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":46,"context_line":"  - description: OpenStack Security"},{"line_number":47,"context_line":"    url: https://security.openstack.org/"},{"line_number":48,"context_line":"  - description: CVE"},{"line_number":49,"context_line":"    url: none"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"author: Goutham Pacha Ravi, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5743be0a_f18a2a4a","line":49,"in_reply_to":"84d89647_09b834a1","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0096.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":60,"context_line":"  - description: OpenStack Security"},{"line_number":61,"context_line":"    url: https://security.openstack.org/"},{"line_number":62,"context_line":"  - description: CVE"},{"line_number":63,"context_line":"    url: CVE-2026-44393"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"author: Goutham Pacha Ravi, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"0b267656_009d5a92","line":63,"updated":"2026-08-18 22:33:21.000000000","message":"We need to programatically check for this: CVE-yyyy-xxxx isn\u0027t a URL, and I think we\u0027ve done this pattern multiple places. We need to include this in a better way.\n\nedit: including looking for description: cve url: none","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":60,"context_line":"  - description: OpenStack Security"},{"line_number":61,"context_line":"    url: https://security.openstack.org/"},{"line_number":62,"context_line":"  - description: CVE"},{"line_number":63,"context_line":"    url: CVE-2026-44393"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"author: Goutham Pacha Ravi, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8254f20e_a53dfba6","line":63,"in_reply_to":"0b267656_009d5a92","updated":"2026-08-24 18:35:52.000000000","message":"Done","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/OSSN-0102.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21f7a05ea9d2b48013a984715920731af1353f8c","unresolved":true,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    GET/PUT /floatingips/{fip_id}/port_forwardings/{pf_id}"},{"line_number":22,"context_line":"    (DELETE is not affected; it already validates the parent)"},{"line_number":23,"context_line":"    GET/PUT/DELETE /routers/{router_id}/conntrack_helpers/{ct_id}"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"  Policy checks authorize against the parent (floating IP or router)"},{"line_number":26,"context_line":"  from the URL. The plugin then loads the child by bare UUID without"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f4e133af_ae40bda1","line":23,"updated":"2026-08-18 22:33:21.000000000","message":"This section (the top of discussion) is rendering badly. I\u0027ve left these without comment in older ones, but this still impacts valid versions of Neutron so we should take a pass to improve it.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8c7842ae81c788d22c934521137c4bc26f85e1e8","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    GET/PUT /floatingips/{fip_id}/port_forwardings/{pf_id}"},{"line_number":22,"context_line":"    (DELETE is not affected; it already validates the parent)"},{"line_number":23,"context_line":"    GET/PUT/DELETE /routers/{router_id}/conntrack_helpers/{ct_id}"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"  Policy checks authorize against the parent (floating IP or router)"},{"line_number":26,"context_line":"  from the URL. The plugin then loads the child by bare UUID without"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"c5b7ea85_f3ad46aa","line":23,"in_reply_to":"f4e133af_ae40bda1","updated":"2026-08-24 18:35:52.000000000","message":"It can\u0027t be made better.","commit_id":"f3b3f76702557843d580a7256dea7a42d028a8ed"}],"security-notes/source/conf.py":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"cff3a8c4182351818ae9a07c9116d60a82fd8611","unresolved":false,"context_lines":[{"line_number":33,"context_line":"# Add any Sphinx extension module names here, as strings. They can be"},{"line_number":34,"context_line":"# extensions coming with Sphinx (named \u0027sphinx.ext.*\u0027) or your custom"},{"line_number":35,"context_line":"# ones."},{"line_number":36,"context_line":"extensions \u003d [\u0027openstackdocstheme\u0027, \u0027ossn_vmt\u0027]"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"# Add any paths that contain templates here, relative to this directory."},{"line_number":39,"context_line":"# templates_path \u003d [\u0027_templates\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"47b286c9_834b0810","line":36,"updated":"2026-08-13 18:35:05.000000000","message":"In the ossa repo we called our local Sphinx extension \"vmt\" but in retrospect it would probably have been better if we\u0027d named it \"ossa\" instead. I think we should make this \"ossn\" and rename ossn_vmt.py to just ossn.py accordingly.","commit_id":"28e0430012236fd1ec699203c35128091671558d"}],"tox.ini":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"cff3a8c4182351818ae9a07c9116d60a82fd8611","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"[doc8]"},{"line_number":61,"context_line":"# Settings for doc8:"},{"line_number":62,"context_line":"# These files have extra long lines that cannot be avoided, let\u0027s ignore them, with depricated txt files."},{"line_number":63,"context_line":"ignore-path \u003d security-notes/OSSN-0047,security-notes/OSSN-0068,security-notes/source,security-notes/build,security-notes/original-txt,common,security-guide/build,security-threat-analysis/build"},{"line_number":64,"context_line":"extensions \u003d .rst,.txt"}],"source_content_type":"text/x-properties","patch_set":3,"id":"a99512c2_259ff1d4","line":62,"updated":"2026-08-13 18:35:05.000000000","message":"\"deprecated\"","commit_id":"28e0430012236fd1ec699203c35128091671558d"}]}