Le mercredi 14 octobre 2026, 08:20:57 heure d’été d’Europe centrale Thomas Goirand a écrit : > On 10/14/26 2:58 AM, Carlos Henrique Lima Melara wrote: > > Hi zigo, > > > > On Tue, Oct 13, 2026 at 08:59:27AM +0200, Thomas Goirand wrote: > >> > >> I have uploaded the a for Keystone in trixie-security, resulting in this > >> DSA > >> yesterday: > >> https://lists.debian.org/debian-security-announce/2026/msg00468.html > >> > >> I have just uploaded (a few minutes ago) its brother update for Bookworm, > >> in > >> Keystone version 22.0.2-0+deb12u5. Here's the changelog entry: > >> > >> keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium > >> > >> * CVE-2026-90460: Delegated tokens (like ec2credential, > >> application_credential, ...) can GET/PATCH/DELETE any credential > >> including > >> TOTP seeds. Delegation project boundary not enforced on PATCH > >> /v3/credentials/{id}. Applied upstream patch: "credentials: reject > >> delegated tokens, restrict PATCH to blob only" (Closes: #1149303, > >> #1149956): > >> - > >> CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch > >> > >> -- Thomas Goirand <[email protected]> Sat, 10 Oct 2026 12:05:37 +0200 > >> > >> I'd appreciate if someone from the LTS team could update the CVE tracking > >> thingy for Keystone in Bookworm (dla-needed.txt or something, right?) and > >> make the LTS security announce for me. > > > > Replying in the ML so we can keep track of the issue you brought up in > > #debian-lts today. > > > > TLDR for others: keystone 2:22.0.2-0+deb12u5 was uploaded to > > bookworm-security and DLA-4834-1 issued. But keystone won't > > automagically restart on the security update so one can have a > > vulnerable keystone even after updating the package. > > > > If you can prepare a 2:22.0.2-0+deb12u6 with the correction to make > > keystone restart on update, that would be really helpful. Then we can > > issue a regression update (DLA-4834-2) for it as rouca mentioned on IRC.
Done DLA issued > > > > Thanks again for keeping openstack in LTS secure! > > > > Cheers, > > Charles > > Hi, > > Thanks for your care. > > Keystone 2:22.0.2-0+deb12u6 uploaded. > > Cheers, > > Thomas Goirand (zigo) > >
signature.asc
Description: This is a digitally signed message part.
