Your message dated Wed, 12 Aug 2026 13:04:15 +0000
with message-id <[email protected]>
and subject line Bug#1144145: fixed in designate 1:22.0.0-2
has caused the Debian Bug report #1144145,
regarding CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034: Cross-tenant DNS zone
overlap and mDNS DoS via pool scheduling
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144145: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144145
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: designate
Version: 1:20.0.0-2
Severity: serious
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-034.html
Date:
August 11, 2026
CVE:
CVE-2026-71193, CVE-2026-71194
Affects:
Designate: >=1.0.0 <20.0.2, ==21.0.0, ==22.0.0
Description:
Tore Anderson of Redpill Linpro AS reported that OpenStack Designate does not
enforce cross-pool zone ownership checks when scheduling a zone to a
non-default pool via the attribute filter. A tenant can create a sub-zone,
super-zone, or duplicate of another tenant’s zone by targeting a different
pool, enabling DNS hijack or denial of service. Independently, Omer Schwartz
of Red Hat identified that the mDNS handler performs pool-blind record
lookups, causing a deterministic denial of service when colliding zones exist
across pools. All deployments using multiple Designate pools are affected.
Patches:
https://review.opendev.org/1000475 (2025.1/epoxy)
https://review.opendev.org/1000474 (2025.2/flamingo)
https://review.opendev.org/1000473 (2026.1/gazpacho)
https://review.opendev.org/1000471 (2026.2/hibiscus (development))
Credits:
Tore Anderson from Redpill Linpro AS
Omer Schwartz from Red Hat
References:
https://launchpad.net/bugs/2160533
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71194
Notes:
The stable branch patches depend on two prerequisite backports (mDNS
split-horizon pool scoping, Change 998005/998006 and their stable equivalents)
that were merged before disclosure. Operators applying the fix to releases
older than the next point release should ensure those prerequisite commits are
present.
Operators should audit existing zones for cross-tenant collisions that may
have been created before the fix. A detection tool will be proposed as a
separate public patch.
--- End Message ---
--- Begin Message ---
Source: designate
Source-Version: 1:22.0.0-2
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
designate, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated designate package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 06 Aug 2026 10:01:30 +0200
Source: designate
Architecture: source
Version: 1:22.0.0-2
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1144145
Changes:
designate (1:22.0.0-2) unstable; urgency=high
.
* CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034:
- An authenticated tenant can bypass zone ownership checks by scheduling a
zone to a different pool, creating overlapping zones that hijack or deny
service to another tenant's DNS records. Any user with the default
create_zone policy can exploit this when the AttributeFilter scheduler is
enabled. Only deployments using the AttributeFilter scheduler with
multiple pools are affected.
- The mDNS handler performs pool-blind record lookups that fail when
colliding zones exist across pools, causing deterministic DNS query
failures. The NOTIFY handler path is reachable via unauthenticated UDP.
Applied upstream patches:
- Require TSIG keys for zones in non-default pools
- Fix mDNS record query pool scoping for split-horizon DNS
- Fix cross-tenant/cross-pool zone ownership bypass
(Closes: #1144145).
Checksums-Sha1:
e545126cb7507e51fc08bc5c0aa1094f530a961a 4248 designate_22.0.0-2.dsc
088c255ce1aa0a2cb51d9647fd9abc3ad1b2b9d4 26624 designate_22.0.0-2.debian.tar.xz
7aed592dbefc0dc375eec413c61cccc07ab03993 21816
designate_22.0.0-2_amd64.buildinfo
Checksums-Sha256:
d9b73375bcc0988989892080e205b6c4f946e45f5eae0936c7699f851d381b36 4248
designate_22.0.0-2.dsc
f0e4c516f33e4c0ab6236758b754dc8b8960b6533ab4fb947a986786c06e755f 26624
designate_22.0.0-2.debian.tar.xz
424681d836e608b01057094ff907b1fecb89e45172c2eb40fea6f6c9c5780cee 21816
designate_22.0.0-2_amd64.buildinfo
Files:
13b36456a71ec3b65d649da5899a7002 4248 net optional designate_22.0.0-2.dsc
2035755bd533c143bd58a6bb265b0e52 26624 net optional
designate_22.0.0-2.debian.tar.xz
b68bfa642150c84d0fb8220e34d1b9ea 21816 net optional
designate_22.0.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8bFMACgkQ1BatFaxr
Q/79Xg/+MMY9EodXPilff+gqzMuWFMejwGoMkn4eVzPXU1g/ZOlD5GYzwf97rQyn
j9RTz5kwy4k56X6Nenm5CKibEhH3DhrPqxhlFwZguFMjOKk1RCQvjxT5hn/LeJdX
zi28guHbgaYRu4WQNP3smtsFk0dIp7SBbqr7i2+V6GrRxLGVG3P6IfE8JdWHxwmc
n6/kK/aFO2jkgldvb4GMpJWFSFTD3bVmvdm5kab5OzkihiyAk9fpkHJHOdcmDzV3
vvVHKZ0ejMBpUii0mXp4tjgJs7ogcwbfkClh23dF2a5dG4lqFDTVcFUJF6klRDAd
GOehORDhgqvgton4vnIc0sM6D7nvwBatquOThWl5OE6gPlHm+bdp+5Hk6aS91rsi
XRBcIv/vgltcAgIRUJBYWWXox/XnJTtGkSZuafHLaCJOxK/iBf5d6zKAyuBE49ZH
5UWszi1jDC6mMdlTnvvBf5Tp8BOVbOUUQxbYUMo+CV0trwhsth/TeKVEJFz53OUp
oqHhC/pgq7eYYidnRkXTUKy6msGQ1D0x37ltbN5iWYF1hEPpIg48dpT+LzWrytSv
z/AiUD/Hzci0TMmtECq9eeBZqWDxbwbWMSEhqlFse0scu3elKgKTthBEFjs1jIas
k4CDFx89TF3sWxBciJEgUBX7uiOPH3zQSuSCfxh+3g/EUI9sPyw=
=/4tG
-----END PGP SIGNATURE-----
pgpf7dhzQdEl2.pgp
Description: PGP signature
--- End Message ---
