-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 09 Oct 2026 13:04:02 +0200 Source: python-glance-store Architecture: source Version: 5.7.0-3 Distribution: unstable Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1149967 Changes: python-glance-store (5.7.0-3) unstable; urgency=medium . * CVE-2026-51773: Fix VIM session cookie leak to untrusted hosts in the VMware datastore driver: _retry_request() now refuses to send any request, and the vmware_soap_session cookie, to a host other than the configured vmware_server_host, so a user-supplied vsphere:// image location cannot exfiltrate vCenter credentials when show_multiple_locations is enabled (Closes: #1149967): - CVE-2026-51773_refuse-vim-cookie-to-untrusted-hosts.patch Checksums-Sha1: 695113230fbd4e5adf361ed8f77cd91419a91d58 3183 python-glance-store_5.7.0-3.dsc 8a11fd3f3d84607a5ff9c8f8b20f68d48f131b99 9656 python-glance-store_5.7.0-3.debian.tar.xz 51c8274c74f64f3df4682a27191e1bf4e1cab6b1 13549 python-glance-store_5.7.0-3_amd64.buildinfo Checksums-Sha256: f40bdd16fb1a5aafd7c928c3c5b3a2c54416c8e30724343ebbed059f9a6dbb16 3183 python-glance-store_5.7.0-3.dsc 4b631f6f17162b3e62d20eaa30bca7ce1cf645ee50f958259be7beb79c5f255f 9656 python-glance-store_5.7.0-3.debian.tar.xz c8b0b44a76a6efdf76440779f8652e7a1cb4a3cd9cd7c63c57ab66ee1839521e 13549 python-glance-store_5.7.0-3_amd64.buildinfo Files: 0ea6f3138bc8e26e16fb877ee0de610d 3183 python optional python-glance-store_5.7.0-3.dsc 0109e88ae5c745c5253c9e6e5b6dee3c 9656 python optional python-glance-store_5.7.0-3.debian.tar.xz 5372e190d35535223c263aa84e6fd998 13549 python optional python-glance-store_5.7.0-3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrIzHIACgkQ1BatFaxr Q/7qwg//cvAmJiMgGZBMigyI9nOsIBJx2vuS+MvrCc8F2P4u4+2Omw5ePrhYNIu6 kYK6gLtP81ow2L/nI865I/Snc1xriMw0n0HIF3aFYygujQb68pOKXcwfVLRo3zMO sIAUHTk++9NgkgeupCjICshmsdzSz5HvN6BEwMIRG1eBJTkZmBitRZ7J1tw21ROE PQQefJUyju9SkyzUSDbTrHvj0dOcLI6uIZlDuHzXn/ZNd1AvuLcZQoZJLEbdGFLQ 6n2G6+QiEfxDXxQGbFF6ilhow4/qR2lmLrLFLXeE/MbPpAwaJEhVINAwVIZgHQpy 24rf9KjpLqV9WGz9Wr9v3YOchNIpmZn4S/GZSqCCkZIOPq0MEzq56xFJKreFjVao XA2y2555nt/yrXeas5Fo8taEdd+3mm+BlwffLRPCMSkVmVb4TRjPtJv7logOsLUu 0oQa7yF5PB6Iv0j8I2DNBzfVJp0LwbESneVZyxF1gHOvAeQhv9I4IteG9wQzlqvc O6Rl2uj1jB+bwO0uP8gkXQ8qNvNVJ4GFC2C6clzc2sQthcCzAQPf6Gd+CUCWNXq+ sd3CzNYHs8PvlN0QgKZOl0+6tT3ZwENJ9ATUsQWyfMVKZwTzyZ28n+YcWbbWUQN9 vxmjSA71jAIgf0zNzyK7i6bDd5p3W7q/t4kANxSuqpvYpf++2XE= =iwm0 -----END PGP SIGNATURE-----
