On Fri, Aug 21, 2026 at 02:08:20PM +0200, Salvatore Bonaccorso wrote: > hi, > > On Fri, Aug 21, 2026 at 09:49:04AM +0200, Thomas Goirand wrote: > > Package: release.debian.org > > Severity: normal > > Tags: trixie > > X-Debbugs-Cc: [email protected] > > Control: affects -1 + src:aodh > > User: [email protected] > > Usertags: pu > > > > Hi, > > > > [ Reason ] > > I'd like to upload aodh 20.0.0-2+deb13u1, in order to address: > > https://security.openstack.org/ossa/OSSA-2026-036.html > > aka: > > https://bugs.debian.org/1144879 > > > > [ Impact ] > > As per upstream announce: > > Aodh does not enforce project scope on the > > alarm listing API when the all_projects query parameter is supplied with a > > false value. A non-admin user holding only the reader role can list alarms > > belonging to other projects, optionally targeting a specific project, > > exposing > > alarm metadata such as webhook action URLs, signal endpoints, and project > > identifiers. > > > > [ Tests ] > > I've run OpenStack functional testing on my CI, and Aodh appeared to > > continue working. On top of this, the patch includes new tests. I've > > also deployed the patched version in production in our public cloud. > > > > [ Risks ] > > Minimum: well tested, and small patch. > > > > [ Checklist ] > > [x] *all* changes are documented in the d/changelog > > [x] I reviewed all changes and I approve them > > [x] attach debdiff against the package in (old)stable > > [x] the issue is verified as fixed in unstable > > > > Please allow me to upload aodh/20.0.0-2+deb13u1 to p-u. > > > > Cheers, > > > > Thomas Goirand (zigo) > > > diff -Nru aodh-20.0.0/debian/changelog aodh-20.0.0/debian/changelog > > --- aodh-20.0.0/debian/changelog 2025-07-11 12:12:52.000000000 +0200 > > +++ aodh-20.0.0/debian/changelog 2026-08-12 09:57:24.000000000 +0200 > > @@ -1,3 +1,16 @@ > > +aodh (20.0.0-2+deb13u1) trixie; urgency=medium > > + > > + * CVE-2026-XXXXX / OSSA-2026-036: Aodh does not correctly enforce project > > + scope when the all_projects query parameter is present with a false > > value. > > + A non-admin project reader can list alarms belonging to other projects > > by > > + passing all_projects=false in a list query, optionally combined with a > > + foreign project_id to target a specific project. Leaked alarm data > > includes > > + trust webhook URLs, Heat signal endpoints, and project identifiers. > > Applied > > + upstream patch: "Fix all_projects=false bypass project scope" > > + (Closes: #1144879). > > This is CVE-2026-76878, can you please expand the changelog to note > it?
One other thing, this does not look it is fixed in unstable yet? Did the upload maybe failed/got interruped? Regards, Salvatore
