-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 12 Aug 2026 09:57:24 +0200 Source: aodh Architecture: source Version: 20.0.0-2+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian OpenStack <[email protected]> Changed-By: Thomas Goirand <[email protected]> Closes: 1144879 Changes: aodh (20.0.0-2+deb13u1) trixie; urgency=medium . * CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce project scope when the all_projects query parameter is present with a false value. A non-admin project reader can list alarms belonging to other projects by passing all_projects=false in a list query, optionally combined with a foreign project_id to target a specific project. Leaked alarm data includes trust webhook URLs, Heat signal endpoints, and project identifiers. Applied upstream patch: "Fix all_projects=false bypass project scope" (Closes: #1144879). Checksums-Sha1: 1dd947c82524f786e26796223ceefa8a8c93b1df 3649 aodh_20.0.0-2+deb13u1.dsc 77a1631906706622a8c43f82ff27328b2bf53fd3 13220 aodh_20.0.0-2+deb13u1.debian.tar.xz 0bf292806a1414e8eb3693ba95db7cd6a143840b 18639 aodh_20.0.0-2+deb13u1_amd64.buildinfo Checksums-Sha256: 3beeeb637abefb2fd59dfff9e58a47e268d11ffad30a5f35222dd16bdf82f73c 3649 aodh_20.0.0-2+deb13u1.dsc eebbd1af189a1315976286b7e872f4bc823322c699024bbd918f5e6439ab3705 13220 aodh_20.0.0-2+deb13u1.debian.tar.xz a4c39fa7feda572a8e45681aeb0395c04e1702234e3616aa7fa00e14780ef040 18639 aodh_20.0.0-2+deb13u1_amd64.buildinfo Files: 7e53ed569476b38d9e2464bb2e7563f8 3649 web optional aodh_20.0.0-2+deb13u1.dsc c8943c37eacaae1c7ace073df9243b78 13220 web optional aodh_20.0.0-2+deb13u1.debian.tar.xz 7122fd63c86b135e48b26374820a2e84 18639 web optional aodh_20.0.0-2+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrOCKYACgkQ1BatFaxr Q/5k8A/+MQdmQ2+fZxzc8En3lKXr6WuKGiS0CYiNv0Z4CGva1cbNXt5THo8KknBK +npMd5mVpml170qfJlvQe1S4UqXzcBTpog40Wprj56VVaCgWOMHKX5sjWfZ8Hfb0 RUqDvkpN/Us5slgbpwuKc3llIb5qgTYgXFkYwexfjMNqWy9/cfzKFzf+2wZ/fLeZ MlZAPDuUfJp6hj43bzxvgQmO2wepgtRMd7X1PRJ1y/MqZV+cFW53G6Bt+wnXwlOs w7xMZuu88v9NBQoAPD5lUcmF3HDSYB1jCvqWk+9km6XrR4rbWPEpglSmTjdulrMC QP5QkbvxYCSlB1VSi3WcY7Mb3cKYimayFU76XX9cBPYcgROj5R2hXJWygt0QNgOa 8B3NIiUFaKC63Fc+rYlxhWNt96hovhCCUYa1Bqo5C/77RnGULS6Ou27sNkasndji NKALBtV89/Ts2Kr4VsjdVtdu2k4uGaLt9IdNKvB1k8qeMk7JeEmodRaekIMVj4j6 Yw94Kt6IoFKlngMtNx46qQxAeDCUuicJwrgJeJB8WwsHRxgZAYo0nf2ktIvCwUNg 9Yhu/7ZVc8E+RQs6TfGDznr7C0h6J8d0vAPS8BxkJJ1eRbDw8XVUc82j6hGoZTbW uiB1nIwB/QkKiX6XpYqlkXocWPjuUEefr4Ks7ys2TWU2XEVSocY= =LNE/ -----END PGP SIGNATURE-----
pgphsCuiWTn_t.pgp
Description: PGP signature
