Your message dated Thu, 24 Sep 2026 19:19:07 +0000
with message-id <[email protected]>
and subject line Bug#1148897: fixed in zaqar 23.0.0~rc1-3
has caused the Debian Bug report #1148897,
regarding CVE-2026-97404 OSSA-2026-042: Zaqar empty URL-Signature header
bypasses authentication
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148897: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148897
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: zaqar
Version: 20.0.0-2
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-042.html
=======================================================================
OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication
=======================================================================
:Date: September 24, 2026
:CVE: CVE-2026-97404
Affects
~~~~~~~
- Zaqar: >=1.0.0 <20.1.2, >=21.0.0 <21.0.2, >=22.0.0 <22.0.2
Description
~~~~~~~~~~~
pple, an independent security researcher, reported that Zaqar's
WSGI transport mishandles an empty URL-Signature header: a request
carrying the header with an empty value bypasses both Keystone
authentication and pre-signed URL verification. An unauthenticated
remote attacker who knows a target project's UUID can then read,
enumerate, create, and delete that project's queues, messages,
claims, and subscriptions. By additionally claiming an
administrative role, the attacker may also perform administrative
operations, such as managing pools and flavors in admin_mode
deployments. Only deployments using the WSGI transport with an
authentication strategy configured are affected; the websocket
transport is not affected.
Patches
~~~~~~~
- https://review.opendev.org/1007162 (2025.1/epoxy)
- https://review.opendev.org/1007161 (2025.2/flamingo)
- https://review.opendev.org/1007160 (2026.1/gazpacho)
- https://review.opendev.org/1007159 (2026.2/hibiscus)
- https://review.opendev.org/1007158 (2027.1/indri (development))
Credits
~~~~~~~
- pple from Independent (CVE-2026-97404)
References
~~~~~~~~~~
- https://launchpad.net/bugs/2164987
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97404
Notes
~~~~~
- This issue is distinct from the EXTRA-SPEC header bypass in
OSSA-2026-029; the fix for that issue removed the EXTRA-SPEC branch
but left the empty-value handling of the URL-Signature header
untouched.
--
Goutham Pacha Ravi
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html
--- End Message ---
--- Begin Message ---
Source: zaqar
Source-Version: 23.0.0~rc1-3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
zaqar, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated zaqar package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 24 Sep 2026 20:56:40 +0200
Source: zaqar
Architecture: source
Version: 23.0.0~rc1-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1148897
Changes:
zaqar (23.0.0~rc1-3) unstable; urgency=high
.
* CVE-2026-97404 / OSSA-2026-042: Zaqar empty URL-Signature header
bypasses authentication. Applied upstream patch "Fix authentication
bypass by empty URL-Signature". (Closes: #1148897):
- CVE-2026-97404_OSSA-2026-042_Fix_authentication_bypass_by_empty_....patch
Checksums-Sha1:
b6c2e25ae8d19e4635875f6bc1d0b29c238469ee 3177 zaqar_23.0.0~rc1-3.dsc
5f5296cc5f1812f2ef1366578d7fab475ce7a58a 10964 zaqar_23.0.0~rc1-3.debian.tar.xz
eaa35eedfc4f71041579c5e264debe84c5da4199 16529
zaqar_23.0.0~rc1-3_amd64.buildinfo
Checksums-Sha256:
a457bab8c3e047b7a8cd4f02b374fb39d0723327d065409cc64d17cc5f7af2e6 3177
zaqar_23.0.0~rc1-3.dsc
100214c5ec0d3f35f46244e3c8be363384f4fd24ee1afed1f793b05603629230 10964
zaqar_23.0.0~rc1-3.debian.tar.xz
35e309f946820f6a3bc25c8de85cf09db35887cdd2fd512b01626fa54a95b854 16529
zaqar_23.0.0~rc1-3_amd64.buildinfo
Files:
f23f60cc856b3e658355a82409ec822f 3177 net optional zaqar_23.0.0~rc1-3.dsc
b763e86d5ba777d7988ad4bd432d9e56 10964 net optional
zaqar_23.0.0~rc1-3.debian.tar.xz
a642b931bf6fd6b3e3fc129b4a0b370d 16529 net optional
zaqar_23.0.0~rc1-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmq1c1gACgkQ1BatFaxr
Q/7fwg//TzVcvSR3mUlb+qSWY4rV3lcZUJguyJ4RA5JPdliV+97kdUkjA7xQ8N0z
x+B5Sdij9SyQ7iSXSMsi/Jfu7L4BeJWmnd9EN3P0X8Y4nS00La587J4y39HhSONU
dl5/RjrTczOV8olb6LKR5To16nE64jEbNWNHOYaK1WTNSuzLo0yq0ew90GYuViIf
DK/oNDckv/m1XjyvJLKlDg4Bh6gw8iv56aStznDfDkoF64MK4Hy7let/9eQ8CoYK
Iqdm9VBc00y1OVGBIMnFUny9BabK7mxG3Pd66RJrZDSZS/SaEYeptR77BrNPW7Ky
9zMKE7Z5ys5B4tktJ1lAIx88g18truaNp8GdKXunzGIxoDoiMiBSiLC6bBbA6eG3
NfxkoKRVGpKfJiUH482E5lE+qwKeRoQL8i6qajSoJv4w6uzVc5J3EyUOAtd4dfMK
v/Xnzu8Tdg0JTnPuG+t+92xXroYTkmfIHIpor3Xptjcgu+XKTxoRgl+b5+DV4l/J
KCjGohNHTAKhS/IpCBb4zUk4dOHYR4cxzlwMmdtUTa5FgCJrfdhi3fi7ufBSyNkT
t6+zqXM+aa6F/W8XSW3IXqOzBRHz5/iPdKNe1/ytYu7hSoRdYBFViIY90lJYa/ju
bKjd9lLLuiqC1QHsLZEUfhx55Rd6Q/uGm4zR4Nq0PKTCJ3Vo56c=
=RSKR
-----END PGP SIGNATURE-----
pgpHpy9HkLBV6.pgp
Description: PGP signature
--- End Message ---
