blazar (18.0.0~rc2-1) unstable; urgency=medium * New upstream release. * Drop patch applied upstream: - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch -- Thomas Goirand Wed, 23 Sep 2026 17:58:15 +0200 blazar (18.0.0~rc1-3) unstable; urgency=medium * CVE-2026-93852: In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases. . CVE-2026-93854: In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check. . Applied upstream patch (Closes: #1148408). - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch -- Thomas Goirand Mon, 21 Sep 2026 17:37:21 +0200 blazar (18.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Sun, 20 Sep 2026 12:46:45 +0200 blazar (18.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. * Do not install blazar-api-wsgi, gone from upstream. -- Thomas Goirand Wed, 09 Sep 2026 20:54:40 +0200 blazar (17.0.0-2) unstable; urgency=medium * Fix "su" parameters order. -- Thomas Goirand Mon, 13 Apr 2026 12:34:52 +0200 blazar (17.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 01 Apr 2026 13:41:19 +0200 blazar (17.0.0~rc1-3) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 27 Mar 2026 08:56:30 +0100 blazar (17.0.0~rc1-2) experimental; urgency=medium * Add OS_OSLO_MESSAGING_RABBIT__PROCESSNAME=blazar-api. -- Thomas Goirand Wed, 18 Mar 2026 09:55:38 +0100 blazar (17.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Rebased install-all-files.patch. * Removed --format when building the policy yaml file. -- Thomas Goirand Wed, 11 Mar 2026 14:27:25 +0100 blazar (16.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 01 Oct 2025 21:37:16 +0200 blazar (16.0.0~rc1-3) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Sun, 28 Sep 2025 23:33:46 +0200 blazar (16.0.0~rc1-2) experimental; urgency=medium * Fixed UWSGI_INI_APP= in api init script. -- Thomas Goirand Thu, 18 Sep 2025 21:56:34 +0200 blazar (16.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Switch blazar-api-uwsgi.ini to module=blazar.wsgi.api:application instead of now removed wsgi-script. * Removed fix-lease-date-not-enough-in-the-future.patch applied upstream. -- Thomas Goirand Fri, 12 Sep 2025 10:09:30 +0200 blazar (15.0.0-3) unstable; urgency=medium * export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons. -- Thomas Goirand Fri, 11 Jul 2025 12:21:03 +0200 blazar (15.0.0-2) unstable; urgency=medium * Add fix-lease-date-not-enough-in-the-future.patch (Closes: #1104885). -- Thomas Goirand Mon, 12 May 2025 12:36:04 +0200 blazar (15.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 02 Apr 2025 13:04:38 +0200 blazar (15.0.0~rc1-3) unstable; urgency=medium * Re-upload source-only. -- Thomas Goirand Tue, 01 Apr 2025 09:25:44 +0200 blazar (15.0.0~rc1-2) experimental; urgency=medium * Fixed d/copyright copyright holder list. -- Thomas Goirand Fri, 14 Mar 2025 16:05:04 +0100 blazar (15.0.0~rc1-1) experimental; urgency=medium * Initial packaging (Closes: #1100490). -- Thomas Goirand Thu, 19 Dec 2024 16:48:27 +0100