File: lockout-command-result-a368187515385270.yaml

package info (click to toggle)
ironic-python-agent 10.2.0-3
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 4,416 kB
  • sloc: python: 35,563; sh: 60; makefile: 29
file content (11 lines) | stat: -rw-r--r-- 559 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
---
fixes:
  - |
    Fixes a potential security issue where a third party may be able to
    retrieve potentially sensitive data in command result output from
    the agent. If a request comes in with an ``agent_token`` to the
    command results endpoint, the agent will now require all future
    calls to leverage the token to retrieve results and validate
    that token's validity. This effectively eliminates the possibility
    of a malicious entity with access to the agent's API endpoint from
    capturing the command results from agent operations.