-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 20 Aug 2026 14:36:03 +0200 Source: watcher Binary: python3-watcher watcher-api watcher-applier watcher-common watcher-decision-engine watcher-doc Architecture: all Version: 14.0.0-1+deb13u2 Distribution: trixie Urgency: medium Maintainer: all Build Daemon (x86-csail-02) Changed-By: Thomas Goirand Description: python3-watcher - OpenStack Cloud Optimization as a Service - Python libraries watcher-api - OpenStack Cloud Optimization as a Service - API server watcher-applier - OpenStack Cloud Optimization as a Service - Applier watcher-common - OpenStack Cloud Optimization as a Service - common files watcher-decision-engine - OpenStack Cloud Optimization as a Service - Decision Engine watcher-doc - OpenStack Cloud Optimization as a Service - doc Closes: 1144880 Changes: watcher (14.0.0-1+deb13u2) trixie; urgency=medium . * CVE-2026-76878 / OSSA-2026-036: Watcher webhook trigger endpoint does not enforce oslo.policy authorization. Any authenticated user who learns a Watcher audit webhook URL can POST to the webhook to trigger an administrator-owned EVENT audit and its associated action plan, regardless of the caller's project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release. Applied upstream patch: "Add policy enforcement to webhook trigger endpoint". (Closes: #1144880) * Added python3-ddt as build-depends, needed for this patch. Checksums-Sha1: 54566f29ec6641a93ebf5186ed299ea47cf5d74b 313224 python3-watcher_14.0.0-1+deb13u2_all.deb c1b49bf6fffb8cae9ba24684f46b0cd617f1421e 25796 watcher-api_14.0.0-1+deb13u2_all.deb 705b7a8e2860222b7a053a5276280964e92346cb 8404 watcher-applier_14.0.0-1+deb13u2_all.deb 197bddede3dea812bce3b6a6379f26d81d1fdf52 39696 watcher-common_14.0.0-1+deb13u2_all.deb 336d0cb9d9ae54e702f83c2b6bb1bacb75083cd0 8432 watcher-decision-engine_14.0.0-1+deb13u2_all.deb 736d9c6b403eea807b58fe6870cd88e6701ed42f 1606308 watcher-doc_14.0.0-1+deb13u2_all.deb c0faad9337ae1f1ba5b93335e588c5374b1bf383 18663 watcher_14.0.0-1+deb13u2_all-buildd.buildinfo Checksums-Sha256: 7e546cd6666b604bc1e6e80a2ca3711974b3fdeb242ece9121af01360f4fb566 313224 python3-watcher_14.0.0-1+deb13u2_all.deb f8de0a547262d90d4736fd727c62cbeca7f3c39f069a021de5602550cb3872e8 25796 watcher-api_14.0.0-1+deb13u2_all.deb ba26bf4627b1e2f0dbabc5120c47cc2402951ce4122434bbe143a1b9eeaf80cc 8404 watcher-applier_14.0.0-1+deb13u2_all.deb 2316fba798e32e4aef602b42df3dda89ae0396eaf696ee2ac2cb35f3f3c3f43d 39696 watcher-common_14.0.0-1+deb13u2_all.deb 03e3d728a1606fe9196159005e17b42be0a3cfdb4341c3d37cdbc18956e64d45 8432 watcher-decision-engine_14.0.0-1+deb13u2_all.deb f6d674a912fdbd1988c3f6438c23c948c496c1c1d65a09c5d861ce8d1cd0a6c7 1606308 watcher-doc_14.0.0-1+deb13u2_all.deb 7a12b21cb8654bebff6d34baf912375e43c43320590bb62f495611374a486305 18663 watcher_14.0.0-1+deb13u2_all-buildd.buildinfo Files: 5119ef2e5282b5f91a5dfe8998da4ebb 313224 python optional python3-watcher_14.0.0-1+deb13u2_all.deb 68d7a093b60ce0c8fdd3c3ca2043f098 25796 net optional watcher-api_14.0.0-1+deb13u2_all.deb 11ec6e60772facc70cb5c8e5d1c7db98 8404 net optional watcher-applier_14.0.0-1+deb13u2_all.deb c47a20d771d01497126ea541736b942d 39696 net optional watcher-common_14.0.0-1+deb13u2_all.deb a39b22edad3d3a2049f7b07b78c22943 8432 net optional watcher-decision-engine_14.0.0-1+deb13u2_all.deb 9d668988df96cc19ceb950a0ecd7e1fe 1606308 doc optional watcher-doc_14.0.0-1+deb13u2_all.deb 8c413b0a91967750645203b281405f1d 18663 net optional watcher_14.0.0-1+deb13u2_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmrvq8QACgkQaBVi67oX tflvzg//f0tokHYhNc8dGvQ6uPNYhrLOhyOYj7XkFMPM6CDPq/scU9uBJnJbrYg0 88Hu5eMnIojONEybO8F/1RGI9arZIIKsL8d0drn7gAgo3QyxZf1EC+LgSHj0fcWv f1OR0P1oKUMrqtH1TlDeLDklyJje0Lpwv9hSgDb+EG/uv89MZazjoXwpvdbrmv6/ 3QZDCok3AdQaW5dsr8U3gsxDTu89kbB879bFevioPXGh9pFR+YYuqQIPfgcBz4Hy p97KNZOVMkG/xZYSl/7A7eW7UPsJgGVebEai/EsBcI5aYoWsyg/lUg5JgDazSAxx EQJBzLGIN4phwat+YlmgNmcDUO4piBkw+UJaa2VaZ8Ra9kwM+kNd8FcDdD9IAAZY EEN51TxH/Q6lXoOnhsiZ1G6pxGJtOl3KolQZ6kpNUQCmx62KHAHquIl6iEtsu8nM r7qlren5h7IoDfYuDTJHgGcPWo/hqq232bpEaoBD3U6ctTrLeYbOMCxHfHzVu1P+ jTGaI+k9JpQ8ZWrBtR0rvm+hjcu40dJ0i+cUzkSc8sn6yi2ld89YhgSmLbSzvM0Q yq8QUE+w01lqEex3jRROGFOaOsPXsHSWKxlxEbA2c6BTeg2EGEjjKZ4Q8fIdy2Km +wDfg9PMMUNGjyIr5kGx7viQRyAT7iWc+lO0G8/Y3FjyAkmeRQQ= =pShS -----END PGP SIGNATURE-----