Le mardi 13 octobre 2026, 08:59:27 heure d’été d’Europe centrale Thomas Goirand a écrit : > Hi, > > I have uploaded the a for Keystone in trixie-security, resulting in this > DSA yesterday: > https://lists.debian.org/debian-security-announce/2026/msg00468.html > > I have just uploaded (a few minutes ago) its brother update for > Bookworm, in Keystone version 22.0.2-0+deb12u5. Here's the changelog entry: > > keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium > > * CVE-2026-90460: Delegated tokens (like ec2credential, > application_credential, ...) can GET/PATCH/DELETE any credential > including > TOTP seeds. Delegation project boundary not enforced on PATCH > /v3/credentials/{id}. Applied upstream patch: "credentials: reject > delegated tokens, restrict PATCH to blob only" (Closes: #1149303, > #1149956): > - > CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch > > -- Thomas Goirand <[email protected]> Sat, 10 Oct 2026 12:05:37 +0200 > > I'd appreciate if someone from the LTS team could update the CVE > tracking thingy for Keystone in Bookworm (dla-needed.txt or something, > right?) and make the LTS security announce for me.
Can do will wait for full build rouca > > Thanks in advance, > Cheers, > > Thomas Goirand (zigo) > >
signature.asc
Description: This is a digitally signed message part.
