-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 13 Oct 2026 14:10:33 +0200
Source: zaqar
Architecture: source
Version: 20.0.0-2+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1142858 1148897 1150261
Changes:
 zaqar (20.0.0-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-66139 / OSSA-2026-029: EXTRA-SPEC header bypasses Keystone
     authentication. Applied upstream patch: "Do not bypass authentication for
     requests with EXTRA-SPEC header". (Closes: #1142858).
   * CVE-2026-97404 / OSSA-2026-042: Zaqar empty URL-Signature header
     bypasses authentication. Applied upstream patch "Fix authentication
     bypass by empty URL-Signature". (Closes: #1148897):
     - CVE-2026-97404_OSSA-2026-042_Fix_authentication_bypass_by_empty_....patch
   * CVE-2026-107363 / OSSA-2026-043: Zaqar WebSocket project substitution
     allows cross-project queue access. Applied upstream patch "Prohibit
     arbitrary project-id for websocket protocol access". (Closes: #1150261):
     - CVE-2026-107363_OSSA-2026-043_Prohibit_arbitrary_project-id_fo....patch
Checksums-Sha1:
 b29b905218bdd631ad8369bc67ef7f6bafdb294f 3185 zaqar_20.0.0-2+deb13u1.dsc
 d36f88b85221f91adc3c101395cfe00d7af0385e 11328 zaqar_20.0.0-2+deb13u1.debian.tar.xz
 f63b2a71aebc9cf47464176a9288eaa44f6f3e15 17321 zaqar_20.0.0-2+deb13u1_amd64.buildinfo
Checksums-Sha256:
 635a0ff79d0170adeb8185a114dd74b11353b87a4badc1d15e130dee578dd22d 3185 zaqar_20.0.0-2+deb13u1.dsc
 4cba727beb5914d4da3cc99fb3779de0d7684ac5202d218956cbed18316359a1 11328 zaqar_20.0.0-2+deb13u1.debian.tar.xz
 6af791212a2ddd8dde7e38555f17892a8e3445469bf367d77ad420e6c28ca5d4 17321 zaqar_20.0.0-2+deb13u1_amd64.buildinfo
Files:
 41915d822ee5224e28d856b175fcfaf2 3185 net optional zaqar_20.0.0-2+deb13u1.dsc
 f8bcf92cc2dfca0870239a9919140dc4 11328 net optional zaqar_20.0.0-2+deb13u1.debian.tar.xz
 39fb533c9273fe5f0fff8998e0e47d32 17321 net optional zaqar_20.0.0-2+deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrOIOIACgkQ1BatFaxr
Q/7NmhAAogkomnATZzC0JRVUrD5TLOCaa4d+Wjf4N9bTbLDHJglE93ST7iYVqfqH
7Nkrb6a4Yb2keKOEL8WBdmeX/ASj0H2Xt6GYsi+9HNn3/Kfsbyt5Q42MwFm8mzSE
n/6cpNpQrURcaWxqMiNzBPS0iQt4XTnk904KSicyYyqYLj2hXyVXL1cI0nCbpzkz
MuFWp/Fq0umA1UbOvodpD+7iFmnf4bJfVDAeZqQz4xjbTQEXlA1Bx5aga6dFbg0J
6D5PJ3xorBhohF99z5nlLLxTCe/XTapPpksHpX9RmFYm2R3i6/VqB1OvFO/uqZyq
OhRgStC/rCHwowSbP23w0gZukOEKGAYxWRYFykIJzQxVu8PblYCvW0Li1kCH+B1T
UFcPN1zbwmcuesi5p5N7sD41vpC8ndtYR7pIr6AFBPvaw+tDGJEddmPiWwBeUCXw
JSLdhSSFOkCAXQPA5W5lQUEv2JNvIdifaEAJTLZV8ky71ShMhwMHnnUR1JFxbPYG
4TJU+vQkDJQHTTH8ZSXFchKZoWvnZN4ir33UtVFhuYD8MijoczcBRCvYzNXUifBo
4jHOcWiSzu+Uofa0NY+gx3mlYUFzv+qSBi9M5BOdZM7wniKu3rS5+Fnna8luwkFf
lLCoDnTrE3BF8Mb8HQ74XKKGniFcv7aWY+MEKP3DVI9sJwzhjKM=
=lzIf
-----END PGP SIGNATURE-----