Hi,
I have uploaded the a for Keystone in trixie-security, resulting in this
DSA yesterday:
https://lists.debian.org/debian-security-announce/2026/msg00468.html
I have just uploaded (a few minutes ago) its brother update for
Bookworm, in Keystone version 22.0.2-0+deb12u5. Here's the changelog entry:
keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium
* CVE-2026-90460: Delegated tokens (like ec2credential,
application_credential, ...) can GET/PATCH/DELETE any credential
including
TOTP seeds. Delegation project boundary not enforced on PATCH
/v3/credentials/{id}. Applied upstream patch: "credentials: reject
delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
#1149956):
-
CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
-- Thomas Goirand <[email protected]> Sat, 10 Oct 2026 12:05:37 +0200
I'd appreciate if someone from the LTS team could update the CVE
tracking thingy for Keystone in Bookworm (dla-needed.txt or something,
right?) and make the LTS security announce for me.
Thanks in advance,
Cheers,
Thomas Goirand (zigo)
