-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 10 Oct 2026 12:05:37 +0200 Source: keystone Architecture: source Version: 2:22.0.2-0+deb12u5 Distribution: bookworm-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1149303 1149956 Changes: keystone (2:22.0.2-0+deb12u5) bookworm-security; urgency=medium . * CVE-2026-90460: Delegated tokens (like ec2credential, application_credential, ...) can GET/PATCH/DELETE any credential including TOTP seeds. Delegation project boundary not enforced on PATCH /v3/credentials/{id}. Applied upstream patch: "credentials: reject delegated tokens, restrict PATCH to blob only" (Closes: #1149303, #1149956): - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch Checksums-Sha1: 8f23451e61b5afcb41b1c62d574db9682d914eae 3565 keystone_22.0.2-0+deb12u5.dsc b0bb8357d3dcf55829e22a2c685892b753c1d06b 95464 keystone_22.0.2-0+deb12u5.debian.tar.xz 1d175a85bb1966839ff4c5aa331a0fc854baecfb 18303 keystone_22.0.2-0+deb12u5_amd64.buildinfo Checksums-Sha256: a82f0546add3199505332d4d553235787c3183203d0045fafe322fa002e0b4c9 3565 keystone_22.0.2-0+deb12u5.dsc 3489356c55d02e40532cc1fae945e4afb9e216e118d136c9d9ed97a7700f6cde 95464 keystone_22.0.2-0+deb12u5.debian.tar.xz 37c65b005ad8bcd4a2f31c233663e9cb1b2c9ba9a45fcbbb0c9dc3a626aae90a 18303 keystone_22.0.2-0+deb12u5_amd64.buildinfo Files: 71966e9025cce756b5f9625ac898ce7f 3565 net optional keystone_22.0.2-0+deb12u5.dsc 4ddded3ec52c7ae705b1e2f83ca818e8 95464 net optional keystone_22.0.2-0+deb12u5.debian.tar.xz 1d09e71da4c2bbf379c58f5c0b257f8b 18303 net optional keystone_22.0.2-0+deb12u5_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrN1gAACgkQ1BatFaxr Q/4UyhAAgMCzB5mmj+bzGY+hlQP4Ga2SA23LPbJ4XMfMFc5xSXgaqIpC2vyIwbx6 uYBHFZB3wprVJ9BfXKcbf+JG6KSJexXWqeOOo5QOFY7TFsIepUk1L5pN4W4F464l 6YZWUn+DkW9MtAqSeipim4CJBIT0WU6lBnbTEfVnaY13n7SPce6P4+r6ja6vnzAL W8XXtsSvVxVpIxhHJElqZqLMo5QHB0RxByl8TLO4Xh2er9DTPrI2QuzDYawfV5MV LO9Z472wSI4dDmXKfu1S25Xgymusfv8lERjqfb0yF2PAFpRW7uahVO9KmTKerlWu LMqQtBsKkaoQ8moJlWiCjALkF15YCAr9HDFt5TSgUgfirSBMS2mT1F/333HtTS/+ 4Ge/qKB+yMyA5o+9mh6QAres57fvRYcBTBos4qKOuu7yEJyPII2uWg6DLsiu+L/1 TunwgdGgvc9AjBynLGs+G+jYrao9zuUjB4jKRh9GPaWtw+pa4pUZ9u3T1w2uzlOn ulrB7TvhaYcqjznD4VaZjXL7K4JbWTbFcOz6ahNbJTV/MIMjxtXgHTCvNRKtdySW hwIh35fBD5+FHicPp1WGZ7wDxt9Dg9x/3hpezwgUZw9bDf9C5ar3eQ7fnVAuRO0h KxhEsaa5vZifbNP+5ZkHzijdMODlocbmPNmhSbmTXsrIcAv/Td8= =m2Et -----END PGP SIGNATURE-----
