Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 59965c5b by Salvatore Bonaccorso at 2026-10-02T11:02:59+02:00 Add a third keystone issue without CVE assignment - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,6 @@ +CVE-2026-XXXX [MFA auth receipt and TOTP are not invalidated after use, allowing replay attacks] + - keystone 2:30.0.0~rc1-2 (bug #1149305) + NOTE: https://bugs.launchpad.net/keystone/+bug/2157347 CVE-2026-XXXX [POST /v3/users/{id}/password does not verify MFA when MFA rules are configured, allowing account lockout with stolen password alone] - keystone 2:30.0.0~rc1-2 (bug #1149304) NOTE: https://bugs.launchpad.net/keystone/+bug/2158970 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/59965c5b31d3793b7e4b9fbaaa6bbe630491c0a2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/59965c5b31d3793b7e4b9fbaaa6bbe630491c0a2 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
