>>> As the vulnerability is scheduled to go public before MOS9 GA date, I also recommend that it is appropriately described in MOS9 release info, suggesting operators to avoid using IPA-based Ironic drivers in MOS9 until next MU. A technical bulletin for users of Ironic in MOS8 should also be created with the same warning.
Adding release-notes tag due to Pavlo's comment:
>>> As the vulnerability is scheduled to go public before MOS9 GA date, I also recommend that it is appropriately described in MOS9 release info, suggesting operators to avoid using IPA-based Ironic drivers in MOS9 until next MU. A technical bulletin for users of Ironic in MOS8 should also be created with the same warning.