-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 05 Nov 2026 12:40:16 +0100
Source: aodh
Architecture: source
Version: 20.0.0-2+deb13u2
Distribution: trixie
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1153094
Changes:
 aodh (20.0.0-2+deb13u2) trixie; urgency=high
 .
   * lp-2167496: Fix an authorization bypass in the alarm listing API where
     duplicated project_id query filters could bypass project scope:
     authorization validated the first filter value while the storage query
     kept the last one, letting a non-admin user list another project's
     alarms, including action URLs. Applied upstream patch: "Duplicated
     query fields are now rejected with a 400 response" (Closes: #1153094):
     - lp-2167496_Fix_duplicate_project_id_query_filter_bypass_project....patch
Checksums-Sha1:
 947ad62e889b2edc6218ba6acb0a7b43697c4633 3649 aodh_20.0.0-2+deb13u2.dsc
 8815f6614b78514da388fc46e399f7d57bab7ee2 14288 aodh_20.0.0-2+deb13u2.debian.tar.xz
 91f52e1e2472c489544242539b1f7bd2763c1248 18639 aodh_20.0.0-2+deb13u2_amd64.buildinfo
Checksums-Sha256:
 ce902448079f979cb0e20b52b6e220073a309bd380b45398cbe90726604dd633 3649 aodh_20.0.0-2+deb13u2.dsc
 88c0c67f8313e8eca97a96a2dd2d8f80fe6c7ac2472729d5e7dc96561da62154 14288 aodh_20.0.0-2+deb13u2.debian.tar.xz
 8e3aa2d3c8f6f1672fd56cc45b30d34ba618aa0db0fe0afdda850e1e0d92343d 18639 aodh_20.0.0-2+deb13u2_amd64.buildinfo
Files:
 b894d08a6587d8ca923b0cdd8f60ca74 3649 web optional aodh_20.0.0-2+deb13u2.dsc
 28c89609bfbccda3d5e3ab96ebe6167c 14288 web optional aodh_20.0.0-2+deb13u2.debian.tar.xz
 755e88a13232613f614870bdf86db275 18639 web optional aodh_20.0.0-2+deb13u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmr0UZEACgkQ1BatFaxr
Q/6Tgw/8Dx3AgmMQgyWttDvjlpCsasIzgcp1L2Q68noD3DhZmgepRhubgRt/Facq
gPkchJrGRcAfNpzlFe8ACs4bpx2vNDZaqtAziiWoOsF8FhgV9P9N0BM6Hd85nue0
q5+7WnVSlSDDp20pGawiyl82Br/Wzw4n6a+xeiJZr/cUJ/uoFN8/blB9VYGoZzF8
xpDivdarQKPwAVD8V0lqvlUh5z7I6HpFIH0oXjIpjaLaajqM0uRJqa0Row6nVpir
ZIR6G0SRCHMA8CvdBfLw2wZ+DSr5BzKcJJEKHmfxsUImwIJ6rq0DEnO2C7c8Ii6T
0+exTRm7N1VCZ4M4Or+/123trxzQSYZ1ishVnM58hG+F6prkNRE4RxIUCUeHildd
HKQ1iHcrshym2UGqrkT5FtEI5BYLQmKY5NGZ7RzK6aC870ChJVg4nSXzTmJBZ3yv
Anp+jYVeqvS2/aqfwetGYGFO3dxwJ+upzqZ9szuPfUwPvxOmlw2+RlEXEgKonwiu
8nPj2AWXndhciio+4HGDEPgQ4HGSFVQnHisQy7TZjrWkop/7Ckt/mEGsl9AvijtI
+yuN4tgTOxQvG0v2FO05tXG+62tw67ReCd2sNj80K/BlRCd1MW7td9tYsDEWVuVP
JDPRjEPAZsjylD9tRX0hmHPUJAh6qj06kuferqKL4y6X3MTc870=
=S0L9
-----END PGP SIGNATURE-----