Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:zaqar User: [email protected] Usertags: pu
Dear Stable release team, [ Reason ] I'd like to upload a new version of Zaqar to address: https://security.openstack.org/ossa/OSSA-2026-029.html aka: https://bugs.debian.org/1142858 [ Impact ] As per upstream announce: OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. [ Tests ] Tests are run at package build time. Otherwise, I do rely on upstream CI for functional tests (as I do not run Zaqar in production myself). [ Risks ] The patch is rather small. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Just upstream patch. Please allow me to upload Zaqar 20.0.0-2+deb13u1 to p-u. Cheers, Thomas Goirand (zigo)
diff -Nru zaqar-20.0.0/debian/changelog zaqar-20.0.0/debian/changelog --- zaqar-20.0.0/debian/changelog 2025-07-11 14:47:00.000000000 +0200 +++ zaqar-20.0.0/debian/changelog 2026-07-29 12:35:45.000000000 +0200 @@ -1,3 +1,11 @@ +zaqar (20.0.0-2+deb13u1) trixie; urgency=medium + + * CVE-2026-66139 / OSSA-2026-029: EXTRA-SPEC header bypasses Keystone + authentication. Applied upstream patch: "Do not bypass authentication for + requests with EXTRA-SPEC header". (Closes: #1142858). + + -- Thomas Goirand <[email protected]> Wed, 29 Jul 2026 12:35:45 +0200 + zaqar (20.0.0-2) unstable; urgency=medium * Add export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME to all daemons. diff -Nru zaqar-20.0.0/debian/patches/CVE-2026-66139_OSSA-2026-029_Do_not_bypass_authentication_for_requests_with_EXTRA-SPEC_header.patch zaqar-20.0.0/debian/patches/CVE-2026-66139_OSSA-2026-029_Do_not_bypass_authentication_for_requests_with_EXTRA-SPEC_header.patch --- zaqar-20.0.0/debian/patches/CVE-2026-66139_OSSA-2026-029_Do_not_bypass_authentication_for_requests_with_EXTRA-SPEC_header.patch 1970-01-01 01:00:00.000000000 +0100 +++ zaqar-20.0.0/debian/patches/CVE-2026-66139_OSSA-2026-029_Do_not_bypass_authentication_for_requests_with_EXTRA-SPEC_header.patch 2026-07-29 12:35:45.000000000 +0200 @@ -0,0 +1,53 @@ +Author: Takashi Kajinami <[email protected]> +Date: Wed, 22 Jul 2026 16:33:48 +0900 +Description: Do not bypass authentication for requests with EXTRA-SPEC header + Commit 9b6edcf6ca5aca45536fb6f5038068e506c9c673 introduced + the mechanism to pass down extra headers to drivers but this introduced + queue access with all authentication and athorization check enforced. + Remove the bypass to prohibit unauthenticated access. + . + Note that the "execute" interface has never been implemented actually + in drivers so this may have no user impact really. +Bug: https://launchpad.net/bugs/2161254 +Bug-Debian: https://bugs.debian.org/1142858 +Change-Id: Iab3a6c3d60d97c66c693964291ebc3cdb298c1b0 +Signed-off-by: Takashi Kajinami <[email protected]> +Origin: upstream, https://review.opendev.org/c/openstack/zaqar/+/998411 +Last-Update: 2026-07-29 + +diff --git a/releasenotes/notes/bug-2161254-55c2748092268fb3.yaml b/releasenotes/notes/bug-2161254-55c2748092268fb3.yaml +new file mode 100644 +index 0000000..a36aeae +--- /dev/null ++++ b/releasenotes/notes/bug-2161254-55c2748092268fb3.yaml +@@ -0,0 +1,6 @@ ++--- ++security: ++ - | ++ `Bug 2161254 <https://bugs.launchpad.net/zaqar/+bug/2161254>`_: Fixed ++ Requests with the ``EXTRA-SPEC`` header bypassed authentication and ++ policy check. +diff --git a/zaqar/transport/middleware/auth.py b/zaqar/transport/middleware/auth.py +index 6bc0444..1e5c53d 100644 +--- a/zaqar/transport/middleware/auth.py ++++ b/zaqar/transport/middleware/auth.py +@@ -32,16 +32,14 @@ + + def __call__(self, environ, start_response): + path = environ.get('PATH_INFO') +- extra_spec = environ.get('HTTP_EXTRA_SPEC') ++ signature = environ.get('HTTP_URL_SIGNATURE') ++ + # NOTE(flwang): The root path of Zaqar service shouldn't require any + # auth. + if path == '/': + return self._app(environ, start_response) + +- signature = environ.get('HTTP_URL_SIGNATURE') +- +- if (signature is None and extra_spec is None) or \ +- path.startswith('/v1'): ++ if signature is None or path.startswith('/v1'): + return self._auth_app(environ, start_response) + + return self._app(environ, start_response) diff -Nru zaqar-20.0.0/debian/patches/series zaqar-20.0.0/debian/patches/series --- zaqar-20.0.0/debian/patches/series 2025-07-11 14:47:00.000000000 +0200 +++ zaqar-20.0.0/debian/patches/series 2026-07-29 12:35:45.000000000 +0200 @@ -1,3 +1,4 @@ #remove-trollius-from-requirements.txt.patch finished-fixing-upstream-tests.patch package-all-files.patch +CVE-2026-66139_OSSA-2026-029_Do_not_bypass_authentication_for_requests_with_EXTRA-SPEC_header.patch
