-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 24 Sep 2026 20:56:40 +0200 Source: zaqar Architecture: source Version: 23.0.0~rc1-3 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1148897 Changes: zaqar (23.0.0~rc1-3) unstable; urgency=high . * CVE-2026-97404 / OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication. Applied upstream patch "Fix authentication bypass by empty URL-Signature". (Closes: #1148897): - CVE-2026-97404_OSSA-2026-042_Fix_authentication_bypass_by_empty_....patch Checksums-Sha1: b6c2e25ae8d19e4635875f6bc1d0b29c238469ee 3177 zaqar_23.0.0~rc1-3.dsc 5f5296cc5f1812f2ef1366578d7fab475ce7a58a 10964 zaqar_23.0.0~rc1-3.debian.tar.xz eaa35eedfc4f71041579c5e264debe84c5da4199 16529 zaqar_23.0.0~rc1-3_amd64.buildinfo Checksums-Sha256: a457bab8c3e047b7a8cd4f02b374fb39d0723327d065409cc64d17cc5f7af2e6 3177 zaqar_23.0.0~rc1-3.dsc 100214c5ec0d3f35f46244e3c8be363384f4fd24ee1afed1f793b05603629230 10964 zaqar_23.0.0~rc1-3.debian.tar.xz 35e309f946820f6a3bc25c8de85cf09db35887cdd2fd512b01626fa54a95b854 16529 zaqar_23.0.0~rc1-3_amd64.buildinfo Files: f23f60cc856b3e658355a82409ec822f 3177 net optional zaqar_23.0.0~rc1-3.dsc b763e86d5ba777d7988ad4bd432d9e56 10964 net optional zaqar_23.0.0~rc1-3.debian.tar.xz a642b931bf6fd6b3e3fc129b4a0b370d 16529 net optional zaqar_23.0.0~rc1-3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmq1c1gACgkQ1BatFaxr Q/7fwg//TzVcvSR3mUlb+qSWY4rV3lcZUJguyJ4RA5JPdliV+97kdUkjA7xQ8N0z x+B5Sdij9SyQ7iSXSMsi/Jfu7L4BeJWmnd9EN3P0X8Y4nS00La587J4y39HhSONU dl5/RjrTczOV8olb6LKR5To16nE64jEbNWNHOYaK1WTNSuzLo0yq0ew90GYuViIf DK/oNDckv/m1XjyvJLKlDg4Bh6gw8iv56aStznDfDkoF64MK4Hy7let/9eQ8CoYK Iqdm9VBc00y1OVGBIMnFUny9BabK7mxG3Pd66RJrZDSZS/SaEYeptR77BrNPW7Ky 9zMKE7Z5ys5B4tktJ1lAIx88g18truaNp8GdKXunzGIxoDoiMiBSiLC6bBbA6eG3 NfxkoKRVGpKfJiUH482E5lE+qwKeRoQL8i6qajSoJv4w6uzVc5J3EyUOAtd4dfMK v/Xnzu8Tdg0JTnPuG+t+92xXroYTkmfIHIpor3Xptjcgu+XKTxoRgl+b5+DV4l/J KCjGohNHTAKhS/IpCBb4zUk4dOHYR4cxzlwMmdtUTa5FgCJrfdhi3fi7ufBSyNkT t6+zqXM+aa6F/W8XSW3IXqOzBRHz5/iPdKNe1/ytYu7hSoRdYBFViIY90lJYa/ju bKjd9lLLuiqC1QHsLZEUfhx55Rd6Q/uGm4zR4Nq0PKTCJ3Vo56c= =RSKR -----END PGP SIGNATURE-----