-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 20 Aug 2026 14:36:03 +0200 Source: watcher Architecture: source Version: 14.0.0-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: Debian OpenStack <[email protected]> Changed-By: Thomas Goirand <[email protected]> Closes: 1144880 Changes: watcher (14.0.0-1+deb13u2) trixie; urgency=medium . * CVE-2026-76878 / OSSA-2026-036: Watcher webhook trigger endpoint does not enforce oslo.policy authorization. Any authenticated user who learns a Watcher audit webhook URL can POST to the webhook to trigger an administrator-owned EVENT audit and its associated action plan, regardless of the caller's project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release. Applied upstream patch: "Add policy enforcement to webhook trigger endpoint". (Closes: #1144880) * Added python3-ddt as build-depends, needed for this patch. Checksums-Sha1: 35e22c401016ebc7afe5600e28ff6eb03dc8dd41 3718 watcher_14.0.0-1+deb13u2.dsc 126a4590758d375a93984a53b97663cec478529d 17928 watcher_14.0.0-1+deb13u2.debian.tar.xz 8cad456e92f61727abf4e4678700ee06cf904f13 18932 watcher_14.0.0-1+deb13u2_amd64.buildinfo Checksums-Sha256: 2d2db813586150465a6113dd263b996776f40c075f6120e21e46a84093863bb5 3718 watcher_14.0.0-1+deb13u2.dsc 3acf4d7f90130ece6c89e0798e8948cee8d920ceff129fd7c464a8144bc406d6 17928 watcher_14.0.0-1+deb13u2.debian.tar.xz 94a63004f942dc701914f38b1d26d8f0b80c906dc78b147bb309e1a3577a129d 18932 watcher_14.0.0-1+deb13u2_amd64.buildinfo Files: fcbce856e0c4d52f7d63a249d211cd09 3718 net optional watcher_14.0.0-1+deb13u2.dsc c6d0abaa378b850008d5621544528ebf 17928 net optional watcher_14.0.0-1+deb13u2.debian.tar.xz 1ef8938c96470dad3e47602b856ddc56 18932 net optional watcher_14.0.0-1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrOB7IACgkQ1BatFaxr Q/5yJA/+JMDuvDLxADOPnvEg13EYs6nSDINCdv84YKX3d/8RrKD7j3CqaJodv5Dh cyNjvLA06K5xBglnbIVKd3iZ0LGICZ4uVsHT1c96WjRu4aHCdR0HBnYBnX3+vzhF wUcdwyIQpRY4xk2vtfOzIyiB/vM05jGu5MtRlcdCQCgwQ7F7ujlqAjFFsNBA7EGG N8yYt+JwoLXSsnYPtloLcwkryL4reSk6+9Z+roqKDrfzqll0wN6n+YE1Gc7TwIlY S4KJncdtNLvz3pYE4PEJm29ttLrASDk0hE1DkJKo7Tc9tVgnTo0/AX+vxuxtRw3o p5e7a4/Ayr+crLMPb+nqIccwr3wrLijDQh4MKJlrz5NS0r7HtGSxMJFfqDq5ieP1 CH64R6wc/Y63MsgtChS+/9IosCtd/Av+Fug1PueEGFqLItaAh2CVSz8cKA3l/BwN R/MIztW2VMBNVB7tXxE/KusRTRCkaBEW15HMNJccUhVwPWp0l6awbfwfzkaZRtZt fNCHKlN4Q5TSTT3K2PkcLC70HCJgbrdjTKwbpb3xosGazZv6aZXR9d+RSavlYJTI nfRu016Xx83AtglM4zbDV/iRMykzTqZJCG984FFGU9pkC18LGTzAV7bI+06KzLR3 M9pJ8e1ElWQ6fm0mYmt3XOor1It2yNZjT//fw/9wU0aRj+bssQs= =fcJC -----END PGP SIGNATURE-----
pgpEdSh2oDQwX.pgp
Description: PGP signature
