Repository navigation
Fixes #40028 - Restrict Dynflow console access - #144
Merged
Merged
Conversation
Require Dynflow console requests to satisfy the proxy authorization checks, including trusted-host checks as well as client certificate validation. A CA-signed client certificate alone must not grant console access. Restrict Dynflow console by trusted hosts
Require Dynflow console requests to satisfy the proxy authorization checks, including trusted-host checks as well as client certificate validation. A CA-signed client certificate alone must not grant console access. Remove unused certificate serial handling
Member
Author
|
[test redmine] |
Fresh CI bundles select JSON 3, but multi_json still passes parser options positionally. Keep the test dependency on JSON 2 so the CVE-2026-107152 regression suite can run without a local override. Reproduced eight JSON parsing errors before this change. The full core suite and RuboCop pass on Ruby 3.0 and 3.1 afterwards. This does not change the published gem runtime dependencies.
Odilhao
force-pushed
the
fix/cve-2026-107152
branch
from
November 12, 2026 20:43
0b41f1c to
0aca8b6
Compare
Contributor
|
[test redmine] |
adamruzicka
approved these changes
Nov 12, 2026
adamruzicka
left a comment
adamruzicka
left a comment
Contributor
There was a problem hiding this comment.
prprocessor is confused, let's get this in
Contributor
|
Thank you @Odilhao ! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Fix CVE-2026-107152: when console authentication is enabled, a client certificate signed by the proxy's CA must not by itself authorize access to the Dynflow console.
Issue: https://projects.theforeman.org/issues/40028
Changes
:trusted_hostsrequirements.The two original source commits remain separate, with original authorship preserved.
Separate test-dependency follow-up
A third commit constrains
jsonto< 3in the Gemfile's test group. Fresh bundles otherwise select JSON 3, which rejects positional parser options supplied bymulti_json. This reproduced eight parsing errors in the suite. The constraint does not alter the published gem's runtime dependencies.Testing
Local validation, not a claim about GitHub Actions:
bundle exec rake test:core— 86 tests, 216 assertions, no failures or errors on Ruby 3.0 and 3.1.For manual verification, enable console authentication and configure the proxy's trusted hosts. Check that a trusted client certificate can access the console, while a certificate for an untrusted host and a request without a client certificate are denied. Authentication-disabled behavior is unchanged.