[GHSA-2ppf-2m6f-6v6f] python-openstackclient: backports to 5.8.1, 6.0.1, 6.2.1 not reflected

[zyl71]

Updates

• Affected products

Comments
Current record: PyPI:python-openstackclient: introduced=0 fixed=6.3.0
Proposed: PyPI:python-openstackclient: introduced=0 fixed=5.8.1 | introduced=6.0.0 fixed=6.0.1 | introduced=6.1.0 fixed=6.2.1

The referenced fix bc60e3bb (master, 2023-06-05, first released in 6.3.0) was cherry-picked to stable/2023.1 (a03e3dbf -> 6.2.1), stable/zed (48148e7a -> 6.0.1) and stable/yoga (f4748f4d -> 5.8.1). I verified each backport's diff, its ancestry in the tag, and the PyPI sdists (fixed versions call common.get_resource_by_id; the preceding release on each line still uses utils.find_resource). 6.1.0 has no stable follow-up and stays affected, which the 6.1.0->6.2.1 range expresses.

Release lines: Lines with releases around the fix (2023-06-05): 5.6 (last 5.6.2 on 2023-02-01, no release after the fix -> stays affected, covered by 0->5.8.1); 5.7 (5.7.0 only, affected); 5.8 (5.8.0 unfixed, 5.8.1 fixed by backport); 6.0 (6.0.0 unfixed, 6.0.1 fixed by backport); 6.1 (6.1.0 only, never fixed -> covered by 6.1.0->6.2.1); 6.2 (6.2.0 unfixed, 6.2.1 fixed by backport); 6.3.0 and every later release contain the master fix. No versions exist between 5.8.1 and 6.0.0. The three proposed ranges cover every line.

Maintainer statements: The GitHub advisory lists only fixed=6.3.0 (the first master release); the NVD record for CVE-2023-6110 carries no version data at all. The OpenStack project itself shipped the fix in stable releases 5.8.1 (yoga), 6.0.1 (zed) and 6.2.1 (2023.1-eom) and documents it in the per-series release notes. Red Hat's CVE page lists no upstream fixed version.

Evidence:

• https://pypi.org/pypi/python-openstackclient/json — 5.8.1 uploaded 2023-09-07, 6.0.1 2024-02-08, 6.2.1 2024-08-07, 6.3.0 2023-09-15; none yanked
• https://api.github.com/repos/openstack/python-openstackclient/compare/5.8.1...bc60e3bb908a7f10c87993d791184bfe46784d6c — Diverged (master fix not in tag) - likewise 6.0.1, 6.2.1; 5.8.0/6.0.0/6.1.0/6.2.0 = ahead (no fix); 6.3.0 = behind (contains fix)
• https://api.github.com/repos/openstack/python-openstackclient/commits/f4748f4d250d4d8eb592b7170f1e020f9ece8df3 — Backport on 5.8.1 (tag identical to this commit), 'cherry picked from 48148e7a', same diff: common.get_resource_by_id replaces utils.find_resource in access_rule.py
• https://api.github.com/repos/openstack/python-openstackclient/commits/48148e7a1197c92febdb3ab1e72085c4eb3d6bf7 — Backport in 6.0.1 (compare behind by 1), cherry picked from a03e3dbf
• https://api.github.com/repos/openstack/python-openstackclient/commits/a03e3dbf75c55561bc3575c53db445868be87a3b — Backport in 6.2.1 (compare behind by 1), cherry picked from bc60e3bb
• https://files.pythonhosted.org/packages/13/cc/8ea4d1a27f95576ae1568839c8313de9c588c7665cb08e26d802bdcaf7ae/python-openstackclient-5.8.1.tar.gz — Sdist grep: access_rule.py uses common.get_resource_by_id, common.py defines it, relnote yaml present (same for 6.0.1, 6.2.1, 6.3.0 sdists); 5.8.0/6.0.0/6.1.0/6.2.0 sdists still use utils.find_resource

Version checks:

• python-openstackclient 5.8.1 (registry 2023-09-07): contains fix: yes via backport f4748f4d250d4d8eb592b7170f1e020f9ece8df3; method: backport-diff + artifact-grep; previous 5.8.0: no
• python-openstackclient 6.0.1 (registry 2024-02-08): contains fix: yes via backport 48148e7a1197c92febdb3ab1e72085c4eb3d6bf7; method: backport-diff + artifact-grep; previous 6.0.0: no
• python-openstackclient 6.2.1 (registry 2024-08-07): contains fix: yes via backport a03e3dbf75c55561bc3575c53db445868be87a3b; method: backport-diff + artifact-grep; previous 6.2.0: no
• python-openstackclient 6.3.0 (registry 2023-09-15): contains fix: yes; method: compare-api (6.3.0...bc60e3bb = behind) + artifact-grep; previous 6.2.0: no

This comes from a systematic comparison of advisory ranges with fix commits and published registry artifacts. Happy to adjust if the maintainers intend otherwise.