From 7f2c2a1a361d759600f5994a5972a77981d548ce Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 30 Mar 2026 13:29:54 -0400 Subject: [PATCH] undf: assign UNDF-2026-000000823; stamp terraform-0001/ansible-0002/ansible-0003 --- UNDF-REGISTRY.json | 3 ++- .../patch/ansible-0002-host-add-group-linear-scan.patch | 1 + .../patch/ansible-0003-handler-notify-host-linear-scan.patch | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index 8b6ff5d05..b7c521d3a 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -820,5 +820,6 @@ "hive-0004": "UNDF-2026-000000819", "hive-0005": "UNDF-2026-000000820", "loki-0001": "UNDF-2026-000000821", - "telegraf-0001": "UNDF-2026-000000822" + "telegraf-0001": "UNDF-2026-000000822", + "ansible-0003": "UNDF-2026-000000823" } diff --git a/defects/ansible/patch/ansible-0002-host-add-group-linear-scan.patch b/defects/ansible/patch/ansible-0002-host-add-group-linear-scan.patch index ee0df9416..a9672266b 100644 --- a/defects/ansible/patch/ansible-0002-host-add-group-linear-scan.patch +++ b/defects/ansible/patch/ansible-0002-host-add-group-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000006 # UNDF: (leave blank) # CWE-407: Host.add_group() and populate_ancestors() use `group not in self.groups` # linear scan on list inside loops — O(A*G) per add_group call, O(H*G*A) total diff --git a/defects/ansible/patch/ansible-0003-handler-notify-host-linear-scan.patch b/defects/ansible/patch/ansible-0003-handler-notify-host-linear-scan.patch index cfefdd6df..d8808fbad 100644 --- a/defects/ansible/patch/ansible-0003-handler-notify-host-linear-scan.patch +++ b/defects/ansible/patch/ansible-0003-handler-notify-host-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000823 # UNDF: (leave blank) # CWE-407: Handler.is_host_notified() uses `host in self.notified_hosts` linear scan # on list — O(H) per notification, O(H^2) total across all hosts