Comment 4 for bug 1673085

Revision history for this message
Matt Riedemann (mriedem) wrote :

The fixes would be:

1. Change the scheduler_hints json schema request validation to limit the length on key/value pairs. Changing the API like that is backward incompatible and generally requires a microversion, which we wouldn't backport to stable branches.

2. To limit the number of hints per server create request, we could introduce a new qouta limit configuration option. This would implicitly change the behavior of the API, so might be in the same boat as #1 for backports.

--

So given we can't really backport at least a microversion bump, then there is probably no reason to issue an advisory for this.