-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 09 Nov 2026 17:49:45 +0100
Source: ironic-python-agent
Binary: ironic-python-agent
Architecture: all
Version: 10.2.0-3+deb13u1
Distribution: trixie
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 ironic-python-agent - bare metal hypervisor API for OpenStack - Python Agent
Closes: 1135646 1142857 1142943
Changes:
 ironic-python-agent (10.2.0-3+deb13u1) trixie; urgency=high
 .
   * CVE-2026-43003: Command injection via chroot execution of tenant-controlled
     binaries. Applied upstream patch: "Add a flag to disable installing
     bootloaders" (Closes: #1135646).
   * CVE-2026-66138 / OSSA-2026-027: command execution via unsanitized config.
     Applied upstream patch: "fix NTP command handling" (Closes: #1142857).
   * CVE-2026-54422 / OSSA-2026-028: credential extraction from Ironic Python
     Agent via malicious container. Applied upstream patch: "Do not expose
     registry pull secret to bootc container" (Closes: #1142943).
Checksums-Sha1:
 2afe16bcc8b3bd92581ad81c3fc47a5b4f1d4436 12977 ironic-python-agent_10.2.0-3+deb13u1_all-buildd.buildinfo
 ed08bd89e38359d0a461d500b15d0a9e2a9f0697 234776 ironic-python-agent_10.2.0-3+deb13u1_all.deb
Checksums-Sha256:
 9dd9a5baaff9c019ead36d0ba7dfe9dfc9d004814041e0203ce75acbad7246b6 12977 ironic-python-agent_10.2.0-3+deb13u1_all-buildd.buildinfo
 024bc27c804325f2738ff11010217862acc738efc5a796fcb9b4d7fd3681b9cb 234776 ironic-python-agent_10.2.0-3+deb13u1_all.deb
Files:
 2cf2b2528caa64b1f1054445695e8a79 12977 net optional ironic-python-agent_10.2.0-3+deb13u1_all-buildd.buildinfo
 bac4fd61b41ce7dd938a2592eafda5b6 234776 net optional ironic-python-agent_10.2.0-3+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmr3jTcACgkQPkCWRKsh
20cIXA/+LV3BqjArdzB1QF27Der7DShxDTt9v8zl8AqRQrQXi+NOQYn88mkRI9Z9
rQztXX3J/f4D64uODHcX+0ZJ9UC96ygiYqIVmsmEemoiLo9oLaVZs+vCkOLlYMoq
DRqaA06TdOEkna0Jw8UhMS4UE+qlRzW80b8uo7jfFW7nmgL/KoAwqnfAqhated7a
YWAcshVwTPWofl8R/gkuKEJkY4A+pHuuw8jlvHLWgq9Zn8AmTS5+E5csGekAaYmp
IKnomm5lW5zVbA7SD2zrL4P+T1vDSvoOpm9RlCOrmsZXaWht0IncUSg3MgOqpROu
634ZA4XT9oEZnDZrtED3qiE/ef7mhrJ7n9z0qhJ4kSaGGYd9ww0JpmEEw5KAc6rh
Z30Y8A6bpprKsaSmSDfxCfjQ6sfLQ29x/ZF4thMdRoTK2wnFwo//1G7JmYMsTq+J
sFfO+R7Nf4k0Kr1zo+51yAw9dBoCbWbgmcOfOEQH1IPl4gvCzxMZ4M2H3eUx7+39
IMQdIcOapYpm9nv1u8EXdAJGZyZDzC9bTGPApbIY1T/r4Gk/x0DriyEpmXAjoXQ0
MtNqybp3DYX0Lgf4aH+kHA0LK5coDcEdXXpJfEwJaM3QsOEktmNwGCLhWeLoh9Or
i/CDkvH1V9BtWJjhN9iBI+3VJk4r/7p5NQKQSBaOONELHnOW5Lg=
=Mmym
-----END PGP SIGNATURE-----