hi, On Fri, Aug 21, 2026 at 09:49:04AM +0200, Thomas Goirand wrote: > Package: release.debian.org > Severity: normal > Tags: trixie > X-Debbugs-Cc: [email protected] > Control: affects -1 + src:aodh > User: [email protected] > Usertags: pu > > Hi, > > [ Reason ] > I'd like to upload aodh 20.0.0-2+deb13u1, in order to address: > https://security.openstack.org/ossa/OSSA-2026-036.html > aka: > https://bugs.debian.org/1144879 > > [ Impact ] > As per upstream announce: > Aodh does not enforce project scope on the > alarm listing API when the all_projects query parameter is supplied with a > false value. A non-admin user holding only the reader role can list alarms > belonging to other projects, optionally targeting a specific project, exposing > alarm metadata such as webhook action URLs, signal endpoints, and project > identifiers. > > [ Tests ] > I've run OpenStack functional testing on my CI, and Aodh appeared to > continue working. On top of this, the patch includes new tests. I've > also deployed the patched version in production in our public cloud. > > [ Risks ] > Minimum: well tested, and small patch. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > Please allow me to upload aodh/20.0.0-2+deb13u1 to p-u. > > Cheers, > > Thomas Goirand (zigo)
> diff -Nru aodh-20.0.0/debian/changelog aodh-20.0.0/debian/changelog > --- aodh-20.0.0/debian/changelog 2025-07-11 12:12:52.000000000 +0200 > +++ aodh-20.0.0/debian/changelog 2026-08-12 09:57:24.000000000 +0200 > @@ -1,3 +1,16 @@ > +aodh (20.0.0-2+deb13u1) trixie; urgency=medium > + > + * CVE-2026-XXXXX / OSSA-2026-036: Aodh does not correctly enforce project > + scope when the all_projects query parameter is present with a false > value. > + A non-admin project reader can list alarms belonging to other projects by > + passing all_projects=false in a list query, optionally combined with a > + foreign project_id to target a specific project. Leaked alarm data > includes > + trust webhook URLs, Heat signal endpoints, and project identifiers. > Applied > + upstream patch: "Fix all_projects=false bypass project scope" > + (Closes: #1144879). This is CVE-2026-76878, can you please expand the changelog to note it? Regards, Salvatore
