-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 13 Oct 2026 14:10:33 +0200
Source: zaqar
Binary: python3-zaqar zaqar-common zaqar-server
Architecture: all
Version: 20.0.0-2+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 python3-zaqar - OpenStack Queueing as a Service - Python libraries
 zaqar-common - OpenStack Queueing as a Service - common files
 zaqar-server - OpenStack Queueing as a Service - API server
Closes: 1142858 1148897 1150261
Changes:
 zaqar (20.0.0-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-66139 / OSSA-2026-029: EXTRA-SPEC header bypasses Keystone
     authentication. Applied upstream patch: "Do not bypass authentication for
     requests with EXTRA-SPEC header". (Closes: #1142858).
   * CVE-2026-97404 / OSSA-2026-042: Zaqar empty URL-Signature header
     bypasses authentication. Applied upstream patch "Fix authentication
     bypass by empty URL-Signature". (Closes: #1148897):
     - CVE-2026-97404_OSSA-2026-042_Fix_authentication_bypass_by_empty_....patch
   * CVE-2026-107363 / OSSA-2026-043: Zaqar WebSocket project substitution
     allows cross-project queue access. Applied upstream patch "Prohibit
     arbitrary project-id for websocket protocol access". (Closes: #1150261):
     - CVE-2026-107363_OSSA-2026-043_Prohibit_arbitrary_project-id_fo....patch
Checksums-Sha1:
 13ef7aa68c284ab8e2aa27742c6a3144a983bac4 203020 python3-zaqar_20.0.0-2+deb13u1_all.deb
 d17392a8efe5b1a5992549bf26b22c2d900db3c9 40516 zaqar-common_20.0.0-2+deb13u1_all.deb
 ce6a0e93138341675b7e8338e675db5ebd5a319c 24728 zaqar-server_20.0.0-2+deb13u1_all.deb
 ab0e5e484b9ed533ef95c308c9d0d4ba9e6347f5 17060 zaqar_20.0.0-2+deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 4e52cda1b193a5230e6a05be2cbca8f43ec1ce611de91af61b931c9c24e33077 203020 python3-zaqar_20.0.0-2+deb13u1_all.deb
 5ff762962fed722cebf2d8f4ac3debab8fc8c93a33bbae4602c89ab875cab5f5 40516 zaqar-common_20.0.0-2+deb13u1_all.deb
 d6c292c235243f568e83c6e6ece0782a85a7adad789a2df4084a991bfea4268e 24728 zaqar-server_20.0.0-2+deb13u1_all.deb
 a40279bdfa9ffa4f9da415f480af984f96c1eb6f5f181f4eb451869ff279d63c 17060 zaqar_20.0.0-2+deb13u1_all-buildd.buildinfo
Files:
 85ade718123d9c3e5307081a6cbc970b 203020 python optional python3-zaqar_20.0.0-2+deb13u1_all.deb
 b56731cd752950eea3299afde4329200 40516 net optional zaqar-common_20.0.0-2+deb13u1_all.deb
 900abd8c410ed1a1010ab5c000ed59b8 24728 net optional zaqar-server_20.0.0-2+deb13u1_all.deb
 e5fdf995f0488808c29507c7a70fb3ad 17060 net optional zaqar_20.0.0-2+deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmr4SgwACgkQaBVi67oX
tfkAUw//WtOsMNH2TqIr/9D2yxQ9uotmD4lWE4p2WpXuK2ZvDp8Nfqq+pHL4yw9q
wFUIdPVVmphONwXbKYrKtoKSbC2/WDr4aDKLXtQNOvLHq0p8JZQzSScbeBGRpJkO
AR8pXSaBO3vNHPyrxwDozprMQiH1Hj5r2OVHuAAerfqm8AjTZa8Tv+gVzbgVDzSK
+NHwwagkere7o+1yerMu+cU1gsUCqmJ1q5KOw3UK9J7cJIUEpbTh6AlDQEU5BjW/
rtQR6dy991cP52hFy+I6F2lU6/SWTfD86/0J2TQL/tTd5Q/vZiQsKolP3zp2SCaS
WSr8uK8li8g+flxG4r5glMbj7YkCMxrpZ40+cTAJgnB5N/kM7g3ceElFxDv5nqRc
Ym8W0Mi3ae9krmPnhMmA5Bk/X3Bk/dEk79i9zmBkvtyIk1iuYRLRyrw7aiK4YFdz
W61YIa93kaGP+avoGCenHQJvugghCYFQUl8sPCkDfHEogK2BjIq5+O4/X7c5hyfH
BtePEMGt5rWK53I/4UcM9lJeyhzoPHhIHmybBfTMTlNO5/wrrlsKfy0ALrTz7Y6Y
LO3ZCcbsaPUKXqc6KycgonGDrXGvQeMQQ7f3FPf1iexVGYNDIaVvofnhPwcX1FH8
cezoNNJTwb70FLLPgRiJWJRcXHmyB8/L2H8Wvk1z/U7NzhcuzUc=
=5JyH
-----END PGP SIGNATURE-----