Hi zigo, On Tue, Oct 13, 2026 at 08:59:27AM +0200, Thomas Goirand wrote: > > I have uploaded the a for Keystone in trixie-security, resulting in this DSA > yesterday: > https://lists.debian.org/debian-security-announce/2026/msg00468.html > > I have just uploaded (a few minutes ago) its brother update for Bookworm, in > Keystone version 22.0.2-0+deb12u5. Here's the changelog entry: > > keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium > > * CVE-2026-90460: Delegated tokens (like ec2credential, > application_credential, ...) can GET/PATCH/DELETE any credential > including > TOTP seeds. Delegation project boundary not enforced on PATCH > /v3/credentials/{id}. Applied upstream patch: "credentials: reject > delegated tokens, restrict PATCH to blob only" (Closes: #1149303, > #1149956): > - > CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch > > -- Thomas Goirand <[email protected]> Sat, 10 Oct 2026 12:05:37 +0200 > > I'd appreciate if someone from the LTS team could update the CVE tracking > thingy for Keystone in Bookworm (dla-needed.txt or something, right?) and > make the LTS security announce for me.
Replying in the ML so we can keep track of the issue you brought up in #debian-lts today. TLDR for others: keystone 2:22.0.2-0+deb12u5 was uploaded to bookworm-security and DLA-4834-1 issued. But keystone won't automagically restart on the security update so one can have a vulnerable keystone even after updating the package. If you can prepare a 2:22.0.2-0+deb12u6 with the correction to make keystone restart on update, that would be really helpful. Then we can issue a regression update (DLA-4834-2) for it as rouca mentioned on IRC. Thanks again for keeping openstack in LTS secure! Cheers, Charles
