Skip to content

[release-4.17] OCPBUGS-99886: Cherry-pick CVE-2026-66138 fix (NTP command injection) - #199

Open
mariocr73 wants to merge 2 commits into
openshift:release-4.17from
mariocr73:OCPBUGS-99886-417
Open

[release-4.17] OCPBUGS-99886: Cherry-pick CVE-2026-66138 fix (NTP command injection)#199
mariocr73 wants to merge 2 commits into
openshift:release-4.17from
mariocr73:OCPBUGS-99886-417

Conversation

@mariocr73

@mariocr73 mariocr73 commented Jul 30, 2026

Copy link
Copy Markdown

Cherry-picks upstream security fix d4926bf ("security: fix NTP command handling", CVE-2026-66138) onto the OCP 4.17 branch.

The value of the ntp_server config option was passed unsanitized into a shell command (chronyd -q '<query>', shell=True) in sync_clock(), allowing arbitrary root command execution at early IPA boot. This patch adds input validation and removes shell=True in favor of shlex.quote().

Upstream: https://review.opendev.org/c/openstack/ironic-python-agent/+/998486
OSSA: https://security.openstack.org/ossa/OSSA-2026-027.html

Related: OCPBUGS-99886

@juliakreger @mariocr73
security: fix NTP command handling
b449789 
Adds basic validation of the NTP server parameter to harden the
usage of the NTP server time setting *AND* also uses shlex.quote
to and removes shell=true from the execution invocation to prevent
any possibliity of injecting a malicious command to be executed.

Related-Bug: 2160050
Assisted-By: Claude Opus 4.6
Change-Id: I69e85a1c5040066674d90a6e12acc30cec96ba76
Signed-off-by: Julia Kreger <juliaashleykreger@gmail.com>
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 30, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 30, 2026

Copy link
Copy Markdown

@mariocr73: This pull request references Jira Issue OCPBUGS-99886, which is invalid:

  • expected dependent Jira Issue OCPBUGS-99888 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is New instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Cherry-picks upstream security fix d4926bf ("security: fix NTP command handling", CVE-2026-66138) onto the OCP 4.17 branch.

The value of the ntp_server config option was passed unsanitized into a shell command (chronyd -q '<query>', shell=True) in sync_clock(), allowing arbitrary root command execution at early IPA boot. This patch adds input validation and removes shell=True in favor of shlex.quote().

Upstream: https://review.opendev.org/c/openstack/ironic-python-agent/+/998486
OSSA: https://security.openstack.org/ossa/OSSA-2026-027.html

Related: OCPBUGS-99886

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from elfosardo and iurygregory July 30, 2026 16:27
@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mariocr73
Once this PR has been reviewed and has the lgtm label, please assign zaneb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mariocr73
OCPBUGS-99886: Fix missing ipaddress/shlex imports for NTP validation
a6936c4 
The CVE-2026-66138 fix (d4926bf) calls ipaddress.ip_address() and shlex.quote() in the new _validate_ntp_server(), assuming both modules are already imported -- true on release-4.19+ (which carry an unrelated is_link_local feature that imports them) but not on this branch. Add the two missing imports so the cherry-picked fix actually runs; without them ci/prow/unit fails with NameError: name 'ipaddress' is not defined.

Related: OCPBUGS-99886
@mariocr73

mariocr73 commented Jul 30, 2026

Copy link
Copy Markdown
Author

/retest-required

@mariocr73 mariocr73 mentioned this pull request Aug 20, 2026
Open
@mariocr73

mariocr73 commented Aug 20, 2026

Copy link
Copy Markdown
Author

/retest

@openshift-ci

openshift-ci Bot commented Aug 20, 2026

Copy link
Copy Markdown

@mariocr73: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/pep8 a6936c4 link true /test pep8
ci/prow/unit a6936c4 link true /test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jkaurredhat

jkaurredhat commented Aug 20, 2026

Copy link
Copy Markdown

/lgtm
/label approve

@openshift-ci

openshift-ci Bot commented Aug 20, 2026

Copy link
Copy Markdown

@jkaurredhat: The label(s) /label approve cannot be applied. These labels are supported: acknowledge-critical-fixes-only, platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, ux-approved, no-qe, rebase/manual, cluster-config-api-changed, run-integration-tests, verified, ready-for-human-review, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, ci/severity-critical, jira/skip-dependent-bug-check, jira/valid-bug, ok-to-test, stability-fix-approved, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

Details

In response to this:

/lgtm
/label approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 20, 2026
@jkaurredhat

jkaurredhat commented Aug 20, 2026

Copy link
Copy Markdown

/label approved

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elfosardo elfosardo Awaiting requested review from elfosardo
@iurygregory iurygregory Awaiting requested review from iurygregory

Assignees

@jkaurredhat jkaurredhat

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mariocr73 @openshift-ci-robot @jkaurredhat @juliakreger