On 10/14/26 2:58 AM, Carlos Henrique Lima Melara wrote:
Hi zigo,
On Tue, Oct 13, 2026 at 08:59:27AM +0200, Thomas Goirand wrote:
I have uploaded the a for Keystone in trixie-security, resulting in this DSA
yesterday:
https://lists.debian.org/debian-security-announce/2026/msg00468.html
I have just uploaded (a few minutes ago) its brother update for Bookworm, in
Keystone version 22.0.2-0+deb12u5. Here's the changelog entry:
keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium
* CVE-2026-90460: Delegated tokens (like ec2credential,
application_credential, ...) can GET/PATCH/DELETE any credential
including
TOTP seeds. Delegation project boundary not enforced on PATCH
/v3/credentials/{id}. Applied upstream patch: "credentials: reject
delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
#1149956):
-
CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
-- Thomas Goirand <[email protected]> Sat, 10 Oct 2026 12:05:37 +0200
I'd appreciate if someone from the LTS team could update the CVE tracking
thingy for Keystone in Bookworm (dla-needed.txt or something, right?) and
make the LTS security announce for me.
Replying in the ML so we can keep track of the issue you brought up in
#debian-lts today.
TLDR for others: keystone 2:22.0.2-0+deb12u5 was uploaded to
bookworm-security and DLA-4834-1 issued. But keystone won't
automagically restart on the security update so one can have a
vulnerable keystone even after updating the package.
If you can prepare a 2:22.0.2-0+deb12u6 with the correction to make
keystone restart on update, that would be really helpful. Then we can
issue a regression update (DLA-4834-2) for it as rouca mentioned on IRC.
Thanks again for keeping openstack in LTS secure!
Cheers,
Charles
Hi,
Thanks for your care.
Keystone 2:22.0.2-0+deb12u6 uploaded.
Cheers,
Thomas Goirand (zigo)
