Source: octavia Severity: serious This has been reported on Launchpad here:
https://bugs.launchpad.net/octavia/+bug/2162101 and here: https://bugs.launchpad.net/octavia/+bug/2162103 though the author probably haven't realized how grave the bug was. In fact, we're talking about an RCE, since it's possible inject any type of command into Haproxy. The fixes are here: https://review.opendev.org/q/Ia6affaafcaa8b22ec2e0c94b3c4007cccaae41ba and here: https://review.opendev.org/q/I23c3ca392233c7e8223a9a00b9ee07c6f4b63615 I'll backport these patches to all the versions of OpenStack I still support, meaning from Bookworm (zed) to Unstable (Gazpacho). Cheers, Thomas Goirand (zigo)
