-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Binary: keystone keystone-doc python3-keystone
Architecture: all
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 keystone   - OpenStack identity service
 keystone-doc - OpenStack identity service - documentation
 python3-keystone - OpenStack identity service - library
Closes: 1149303 1149956
Changes:
 keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
 .
   * CVE-2026-90460: Delegated tokens (like ec2credential,
     application_credential, ...) can GET/PATCH/DELETE any credential including
     TOTP seeds. Delegation project boundary not enforced on PATCH
     /v3/credentials/{id}. Applied upstream patch: "credentials: reject
     delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
     #1149956):
     - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
 c100bbbd73e86f0ebd7705a032c49186c313f5df 2261508 keystone-doc_27.0.0-3+deb13u6_all.deb
 54429b2e559733c3e00940fa329be526803a1ca3 18644 keystone_27.0.0-3+deb13u6_all-buildd.buildinfo
 e29c93c235130ab1d155c805040e4e28144405b2 75676 keystone_27.0.0-3+deb13u6_all.deb
 1970fa2c2d3a550c8a326fa4dc71d983f7250b41 745644 python3-keystone_27.0.0-3+deb13u6_all.deb
Checksums-Sha256:
 3ff7785826d4eb3ec70288c1a560bd3d60dfd68ff62ac56d0fd6d33eed4e4d15 2261508 keystone-doc_27.0.0-3+deb13u6_all.deb
 14e8cc859bd8d8018fca292a917109116a13cbfd4ba503e1216bfeb3c8d9d4cc 18644 keystone_27.0.0-3+deb13u6_all-buildd.buildinfo
 34a3cb8462a410bf80d7e88f37522aaf359fc3cb2711ac34a43c121a9515b909 75676 keystone_27.0.0-3+deb13u6_all.deb
 6f0dba61b4c78ffa66547669829368862a8a28de1496bf84b72c9a918a323bac 745644 python3-keystone_27.0.0-3+deb13u6_all.deb
Files:
 a5a8cdd7efb6cbcf4932ba2c3bcbfba1 2261508 doc optional keystone-doc_27.0.0-3+deb13u6_all.deb
 4ed8d2997c499a1fecacb4b876640e05 18644 net optional keystone_27.0.0-3+deb13u6_all-buildd.buildinfo
 af6eb0ec06dd6f0539479a137a24c48d 75676 net optional keystone_27.0.0-3+deb13u6_all.deb
 e6cc1b3eacb409e2aa84dd63bc1dcd3c 745644 python optional python3-keystone_27.0.0-3+deb13u6_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmrKFTcACgkQaBVi67oX
tfm+KQ//S0TX4Y3oBAmniih0miAGh1lpTkZdLGuph7MtHtxx+1zdIksXtbvgwVIA
tCRx9ui6P7+69szU/8UUGxvEgMXsaewbLnHuWlpRkXVGxNFRK4wdoWBuJMdAWoH/
5olpeIzRVBAAwnRxfR04FeqelSga8oIn0mWE47/HhDysIjEKpe21cb6d+NcIKBsK
EyM6tabIS0ZKs2U6K64QJpQcX4Cw7/YqheVI58ybE9ibgJSpdoi8HcP++MdLRJiR
M7cZgGeqPaIf43ijZWHY3bsJNZ5hZ8/aWImeWGXWFB1xUoeSYsthEvnPatSl7OWj
G8XafApUTQ81o4b/Jy/lyznn8eNmUUYuCQ83JxIIA7ZdeCq5Z/GyNrlra2KLXElx
3INDB4I+Q2RXt/7OxDoYUcB4a4L8QVUI2P9SMN6DV65hMUzwxNZUnfcnUr/gNOWO
rJNcNWvBrNG02lWVPcF/8ks4F97OTXYtXHmFSiTB8NS3UAAlHkqV8eKfTek/ZUHW
okOwulNFowufNp1pjwoCMvDfF3XfmRsSeB9D2LxE83UCrYlu59Bsh74bRlTTfs0h
bZ48RpuHJz9wWZ/3btUEKFry6IGZs+xCS9wvwKGQ+RpaG0puQzxm+owpPXdb/63G
UgyhpXwR7YC1eb7lqbPQVCw/scN3s+ykUbVgxRebkJFiFZEEUK0=
=OcUP
-----END PGP SIGNATURE-----