-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 06 Aug 2026 10:54:54 +0200 Source: designate Architecture: source Version: 1:15.0.2-0+deb11u1 Distribution: bookworm-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1144145 Changes: designate (1:15.0.2-0+deb11u1) bookworm-security; urgency=medium . * New upstream point release. * CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034: - An authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool, creating overlapping zones that hijack or deny service to another tenant's DNS records. Any user with the default create_zone policy can exploit this when the AttributeFilter scheduler is enabled. Only deployments using the AttributeFilter scheduler with multiple pools are affected. - The mDNS handler performs pool-blind record lookups that fail when colliding zones exist across pools, causing deterministic DNS query failures. The NOTIFY handler path is reachable via unauthenticated UDP. Applied upstream patches: - Require TSIG keys for zones in non-default pools - Fix mDNS record query pool scoping for split-horizon DNS - Fix cross-tenant/cross-pool zone ownership bypass (Closes: #1144145). Checksums-Sha1: 877bed9ceef891d15afd5ac6862dcb23f9241e74 4427 designate_15.0.2-0+deb11u1.dsc 9143227d82d3f36c92f1cde13181f1cd6bb9f611 759124 designate_15.0.2.orig.tar.xz e30b1a1d6b201793ba37e16656ea77eded803788 23192 designate_15.0.2-0+deb11u1.debian.tar.xz 48eaaa3b5076ededc4b35c518c6a0bbda6b0a7f8 21685 designate_15.0.2-0+deb11u1_amd64.buildinfo Checksums-Sha256: 21319a9999f8f54c356fad9f61341dcc2914dd2719b1f549bee52cb822040a7e 4427 designate_15.0.2-0+deb11u1.dsc b436fd8d6719cae6e0af1849294d7ea869165be07398271255ac047a1dd0f1a1 759124 designate_15.0.2.orig.tar.xz a2a4105fb3eec37ce2d8cabf46cdcdebcbb4edcd12b3d881ce66388aecffb690 23192 designate_15.0.2-0+deb11u1.debian.tar.xz fdaec1f230976710a221fa858132ec87b9458bc782d136e755ee1ceef077bad8 21685 designate_15.0.2-0+deb11u1_amd64.buildinfo Files: e90dbf25883ab0873ad25dcd19534051 4427 net optional designate_15.0.2-0+deb11u1.dsc 85f84c5d5fc8d61c3b5bf53e3bd59383 759124 net optional designate_15.0.2.orig.tar.xz 4e0cb9bebfd82518f741674dad2010c9 23192 net optional designate_15.0.2-0+deb11u1.debian.tar.xz 43460d629fb85d9be4baa94cf9ab6469 21685 net optional designate_15.0.2-0+deb11u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqG6OIACgkQ1BatFaxr Q/4HrA//dbxkn62CI330hyJsEoG+pjLb4Bul0g5ZCahl4gvgUTWpvpFYE5J19SPr iRTvlGsMXOwuC9BXj3pn36Ufx6G+HESgWtHGuWLr/7WbAl/cveyGq8GWy7INWD6C niSl7mKCf1m7gdDNE8Dmo8ViBlkA7iozK4mX25BfarUR3YtHCISNVZ5LoalghiIx 9zqpf0WDYDCe18+SaswET0Ew5avanLYpsIQpVg8Uf8diie1ksmjym7ZZRg/AbPfq 6Swh7qIl/bPmtNZLa5UQHV7v8Y139Bb0/TAD8N0v6PPWwaKqW9djKK1V4RjwGlUa gnIcmZwn81uuTT9u5J8EVTb9zTPVNIyGzYtsU+ojAch8ftBMZ4R37M66umOW5Z0r uCIAIfUtjNHNTlx6O1F6dKftphbL/cPRrHhieHnKSohECPuTJezgv6PJy2k0mvqt bBbQtQWCNi/lY4o0DrCfKxEREICrhhFvQSvRVHDikLQFjLzAhneJRCeSkvpvKvwI t8dW2J9GTX4qp1zTLEmG89AtWSGFgYkvy65wMI3LB4bUMofMHk9Y3imCsnwVuNOc 74X8BHuXi29i9Sj5HKe7MUG7ySSeUFNBSRnd8EN3caV4gE0N7ssHx7khR90cYLu7 VBGx20uWoXhtG+3L5cr+JwQuHtDRJfjQM486v7fu8PUS/KdIDiM= =dbgC -----END PGP SIGNATURE-----
