-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1149303 1149956
Changes:
 keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
 .
   * CVE-2026-90460: Delegated tokens (like ec2credential,
     application_credential, ...) can GET/PATCH/DELETE any credential including
     TOTP seeds. Delegation project boundary not enforced on PATCH
     /v3/credentials/{id}. Applied upstream patch: "credentials: reject
     delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
     #1149956):
     - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
 09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc
 896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
 b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Checksums-Sha256:
 d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486 keystone_27.0.0-3+deb13u6.dsc
 223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444 keystone_27.0.0.orig.tar.xz
 21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Files:
 c3398356872e13542e0df92267c52f48 3486 net optional keystone_27.0.0-3+deb13u6.dsc
 d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional keystone_27.0.0.orig.tar.xz
 d1af659b458b6f88b5ae55ad68ed56da 89448 net optional keystone_27.0.0-3+deb13u6.debian.tar.xz
 5a75b199114e065670506b0b3f364a10 18938 net optional keystone_27.0.0-3+deb13u6_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr
Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze
VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ
ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT
n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA
9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4
TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC
tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm
N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX
KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/
D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw
blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA=
=y9oi
-----END PGP SIGNATURE-----