-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 06 Aug 2026 10:01:30 +0200 Source: designate Architecture: source Version: 1:22.0.0-2 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1144145 Changes: designate (1:22.0.0-2) unstable; urgency=high . * CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034: - An authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool, creating overlapping zones that hijack or deny service to another tenant's DNS records. Any user with the default create_zone policy can exploit this when the AttributeFilter scheduler is enabled. Only deployments using the AttributeFilter scheduler with multiple pools are affected. - The mDNS handler performs pool-blind record lookups that fail when colliding zones exist across pools, causing deterministic DNS query failures. The NOTIFY handler path is reachable via unauthenticated UDP. Applied upstream patches: - Require TSIG keys for zones in non-default pools - Fix mDNS record query pool scoping for split-horizon DNS - Fix cross-tenant/cross-pool zone ownership bypass (Closes: #1144145). Checksums-Sha1: e545126cb7507e51fc08bc5c0aa1094f530a961a 4248 designate_22.0.0-2.dsc 088c255ce1aa0a2cb51d9647fd9abc3ad1b2b9d4 26624 designate_22.0.0-2.debian.tar.xz 7aed592dbefc0dc375eec413c61cccc07ab03993 21816 designate_22.0.0-2_amd64.buildinfo Checksums-Sha256: d9b73375bcc0988989892080e205b6c4f946e45f5eae0936c7699f851d381b36 4248 designate_22.0.0-2.dsc f0e4c516f33e4c0ab6236758b754dc8b8960b6533ab4fb947a986786c06e755f 26624 designate_22.0.0-2.debian.tar.xz 424681d836e608b01057094ff907b1fecb89e45172c2eb40fea6f6c9c5780cee 21816 designate_22.0.0-2_amd64.buildinfo Files: 13b36456a71ec3b65d649da5899a7002 4248 net optional designate_22.0.0-2.dsc 2035755bd533c143bd58a6bb265b0e52 26624 net optional designate_22.0.0-2.debian.tar.xz b68bfa642150c84d0fb8220e34d1b9ea 21816 net optional designate_22.0.0-2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8bFMACgkQ1BatFaxr Q/79Xg/+MMY9EodXPilff+gqzMuWFMejwGoMkn4eVzPXU1g/ZOlD5GYzwf97rQyn j9RTz5kwy4k56X6Nenm5CKibEhH3DhrPqxhlFwZguFMjOKk1RCQvjxT5hn/LeJdX zi28guHbgaYRu4WQNP3smtsFk0dIp7SBbqr7i2+V6GrRxLGVG3P6IfE8JdWHxwmc n6/kK/aFO2jkgldvb4GMpJWFSFTD3bVmvdm5kab5OzkihiyAk9fpkHJHOdcmDzV3 vvVHKZ0ejMBpUii0mXp4tjgJs7ogcwbfkClh23dF2a5dG4lqFDTVcFUJF6klRDAd GOehORDhgqvgton4vnIc0sM6D7nvwBatquOThWl5OE6gPlHm+bdp+5Hk6aS91rsi XRBcIv/vgltcAgIRUJBYWWXox/XnJTtGkSZuafHLaCJOxK/iBf5d6zKAyuBE49ZH 5UWszi1jDC6mMdlTnvvBf5Tp8BOVbOUUQxbYUMo+CV0trwhsth/TeKVEJFz53OUp oqHhC/pgq7eYYidnRkXTUKy6msGQ1D0x37ltbN5iWYF1hEPpIg48dpT+LzWrytSv z/AiUD/Hzci0TMmtECq9eeBZqWDxbwbWMSEhqlFse0scu3elKgKTthBEFjs1jIas k4CDFx89TF3sWxBciJEgUBX7uiOPH3zQSuSCfxh+3g/EUI9sPyw= =/4tG -----END PGP SIGNATURE-----
