-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 12 Aug 2026 09:52:46 +0200 Source: aodh Architecture: source Version: 22.0.0-3 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1144879 Changes: aodh (22.0.0-3) unstable; urgency=high . * CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce project scope when the all_projects query parameter is present with a false value. A non-admin project reader can list alarms belonging to other projects by passing all_projects=false in a list query, optionally combined with a foreign project_id to target a specific project. Leaked alarm data includes trust webhook URLs, Heat signal endpoints, and project identifiers. Applied upstream patch: "Fix all_projects=false bypass project scope" (Closes: #1144879). Checksums-Sha1: 3bd1b94b8580af7c5df0a2c4add5ac16863ab492 3532 aodh_22.0.0-3.dsc 0d0f799311aca291c1cd9cfcd6791c8f464a2602 13444 aodh_22.0.0-3.debian.tar.xz e08793efee0a5db1a2c53a4d987cbe8ae73c5f1a 17600 aodh_22.0.0-3_amd64.buildinfo Checksums-Sha256: 165778b0999339843f7c1f904a7c8f85e1c50f05b990332393be3e5c2ea085c8 3532 aodh_22.0.0-3.dsc f864ba03bd4b945b5279a3c5be823715be4dc134b7ed11842a6e63392200a603 13444 aodh_22.0.0-3.debian.tar.xz dc7b2d53b69a146579d81657bd5c37d58d3509c08def31540556cd58a8f28ff9 17600 aodh_22.0.0-3_amd64.buildinfo Files: b479d26a723ca5169cdbca4653b17aed 3532 web optional aodh_22.0.0-3.dsc d4342762b689f2953c6e4b75befe6ba5 13444 web optional aodh_22.0.0-3.debian.tar.xz 35e453ec4fbf3c0284afe233e2e6e64e 17600 web optional aodh_22.0.0-3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqMTw8ACgkQ1BatFaxr Q/7yGQ//dcbAwfsI7AlxmUM3gdfbFijMGuq47Y+wURmvSMWdKWj3mwvuCQYceJl8 zjSI89nCjsxSB+XoCREjIgROpGefJDUPO6U67QJVXIDYK5KGqzuDwPWRE9llZNIM 11/Qi+yjic/w8TjG6OzIIQ8NIIOeZUSdIkC1Au/7ZXbrb7obRE12X8iuXomrNbj3 Sjow5bxtRZ2bQRBtlyul4/zwQqq3oKtnMgTqwzqUA16j9A6MC61AcqRhcc8gKtpr p5KC0xzUEioM8VwyIcB4jMSisELgneH1dBNhsZWxEoCF98s/07bNyL0v5dGmJikP BmJnfAsc3oCd/7TrZBtiD9wVuMhO6v5oiPzMZPkgI+eSkAp1W5Ij38r51sj0EV3U eO59M0NQKVQ3loTY/gU7sXSkFFtJzvYR40m2IEEkymZ6NDgn13em6eZ8vZyFCeIW O6CbQBroRgdo2p8ZBE7s5kh2NOtb3kURadqbd0KJxCp0mnujbUqI39rYhQKc9S/X iRqY0Q9ABYcAWVkhyApK7fh45xpn/fj0HozQOduhZ6nOh5vEZY//kxfBY1Kcztx6 Vv2JJ+NDos0d31p1kSy0tNHK8qgTuQHCBMIGsy+dZWRM5h5w0QTJP0Q3fLFC5Csx TLZ36ir72E0mygBPD1O7BRDi+lwuWNbO95Aa9S8EnaPdQBOAjOo= =rZ8B -----END PGP SIGNATURE-----
