-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 12 Aug 2026 09:57:24 +0200
Source: aodh
Binary: aodh-api aodh-common aodh-doc aodh-evaluator aodh-expirer aodh-listener aodh-notifier python3-aodh
Architecture: all
Version: 20.0.0-2+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 aodh-api   - OpenStack Telemetry (Ceilometer) Alarming - API server
 aodh-common - OpenStack Telemetry (Ceilometer) Alarming - common files
 aodh-doc   - OpenStack Telemetry (Ceilometer) Alarming - doc
 aodh-evaluator - OpenStack Telemetry (Ceilometer) Alarming - alarm evaluator
 aodh-expirer - OpenStack Telemetry (Ceilometer) Alarming - expirer
 aodh-listener - OpenStack Telemetry (Ceilometer) Alarming - listener
 aodh-notifier - OpenStack Telemetry (Ceilometer) Alarming - alarm notifier
 python3-aodh - OpenStack Telemetry (Ceilometer) Alarming - Python libraries
Closes: 1144879
Changes:
 aodh (20.0.0-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce project
     scope when the all_projects query parameter is present with a false value.
     A non-admin project reader can list alarms belonging to other projects by
     passing all_projects=false in a list query, optionally combined with a
     foreign project_id to target a specific project. Leaked alarm data includes
     trust webhook URLs, Heat signal endpoints, and project identifiers. Applied
     upstream patch: "Fix all_projects=false bypass project scope"
     (Closes: #1144879).
Checksums-Sha1:
 a7b4994e5108d284bf6e1a2ec49a00f498e4364b 25796 aodh-api_20.0.0-2+deb13u1_all.deb
 ed84a478bc7609e650c9de860c2755636da602bd 40884 aodh-common_20.0.0-2+deb13u1_all.deb
 8e2ec3e28a34d5ae54e4d906b59a441368310147 1007152 aodh-doc_20.0.0-2+deb13u1_all.deb
 53a8d21644f79196e106af7c74fcad34d5628e3f 7716 aodh-evaluator_20.0.0-2+deb13u1_all.deb
 b4b8b44d42aee28aabcebd74ec29203f9797037c 7768 aodh-expirer_20.0.0-2+deb13u1_all.deb
 610abc9c2c644324f653c7cf7b20c6c0bae784da 7732 aodh-listener_20.0.0-2+deb13u1_all.deb
 2984d8ce2a5fe0bae01b335515058bbe34eb0c76 7724 aodh-notifier_20.0.0-2+deb13u1_all.deb
 f91b78c8121be478dd8b02a679eb127bf8711093 18366 aodh_20.0.0-2+deb13u1_all-buildd.buildinfo
 6604adbac37c9ae167b344805b59dd298d7e5fcc 96372 python3-aodh_20.0.0-2+deb13u1_all.deb
Checksums-Sha256:
 1e4eb6e6fccb16511a0d7f81d4ccd6e4d11ca8c8ddb815354e7b4164fead99a1 25796 aodh-api_20.0.0-2+deb13u1_all.deb
 4efff256dcb957755bb787e3eff4f65a28127847ff8006223451ae2d809d2059 40884 aodh-common_20.0.0-2+deb13u1_all.deb
 83372b6bfca5702375182ef8854c74c796273248e88bce464e1e0b72810f5aca 1007152 aodh-doc_20.0.0-2+deb13u1_all.deb
 9b9c21672fddf6a2fd9a9e6f022bda2cb849d553f7302acc3e386dab544e6760 7716 aodh-evaluator_20.0.0-2+deb13u1_all.deb
 4d04b2b5a334e265a1bcbf591353815212bfd7452880ab3e562e28bab96a40e3 7768 aodh-expirer_20.0.0-2+deb13u1_all.deb
 1ca10eac74fc0da42ec35cac8a4a6dfc015ade61de3e50cc134dbbe97c77b91e 7732 aodh-listener_20.0.0-2+deb13u1_all.deb
 392dd86436cd1b91568b3502d6a27177ff1d4e6e922edba8008e51c729f4b10c 7724 aodh-notifier_20.0.0-2+deb13u1_all.deb
 c0f370e622a39a096b017533cb6ee8f20ad68d249f41baf5752c6ea22678cd16 18366 aodh_20.0.0-2+deb13u1_all-buildd.buildinfo
 aeb1effb8ee36ecb931becfddac6aba73bfae0e5f22910a991ec4673003dd29e 96372 python3-aodh_20.0.0-2+deb13u1_all.deb
Files:
 0cf6fd02852268be1b8c17e91ed516dd 25796 web optional aodh-api_20.0.0-2+deb13u1_all.deb
 e3597d0e1e38bb79790da0effdef4ff6 40884 web optional aodh-common_20.0.0-2+deb13u1_all.deb
 25f3bada94d2f310a2746fc9cc9d2406 1007152 doc optional aodh-doc_20.0.0-2+deb13u1_all.deb
 1d2edc3460a3eb1b5d3618c9b7940bf8 7716 web optional aodh-evaluator_20.0.0-2+deb13u1_all.deb
 0e17ec40a878eca5c196858117c45a61 7768 web optional aodh-expirer_20.0.0-2+deb13u1_all.deb
 edde6795c9269803332347dc5c806d98 7732 web optional aodh-listener_20.0.0-2+deb13u1_all.deb
 31046762432109787f66edd56d48a55a 7724 web optional aodh-notifier_20.0.0-2+deb13u1_all.deb
 d7c5346e72e75a4c2b20e1aa667178a5 18366 web optional aodh_20.0.0-2+deb13u1_all-buildd.buildinfo
 26b3bd9caf447b691802cfc51b999a09 96372 python optional python3-aodh_20.0.0-2+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmrsnWAACgkQmgPNRvTf
/zcWNRAAmsKF0yCn4/fgMXuCS2BE+QvFVnjI7CnCR5lkGKxlgj7/4ZHvZLB/i1Dl
86J1NcRWEUGe2DeWBWkajDR92UelT600eqnUfURkhYB0LjvfgKFx9BiSwp7G8LPm
3SiM4g9u5AxU+/Hp8E3M1Qq0pYiFrBduxHqUtp+mPdSOEJ8lonum2cMPd+wYJW2j
Hra+5hAJTwxQH3lY8OlhNKsCcCFyuOi3GWlYt7wzLKri8CNfsWv30uOpHT4YWrEw
8S/dd0GtGMoNF8eGyp4ZriHZbYn47runxW/mbvQUH7GJBXKztjhsunp6K76+C29Z
i7Lo0YOcIhS/ytFHhjFpDGXYN5SG/wQ073vcY55rCjDBopHq24NfNCg/fCPsE34s
zQsaT5eDqQjtIk4iZBQLgGcj5RxbjTlFeEWkbndjzo8rkH9U7ZbLKSuhz8kRtKvl
wfMpXcviFs5FwQckhczi2kbXlJ/v7iGddT1Nv6867XFgp8otTIOnLiBNmgH9p0ii
mWwPIj5TPifJqQSmOyrJDRKmdrW6FAzdLb2+y+OoRnyn9GqlL0Sr6Xar80GxUfm7
nv4JkFmI1R4REJyVEyYUnOVVHIjcwsYsZLQ92+rTm5CgZ6cO0IuK9+na0deorm+J
8FivrW8hMQ9hEVnQlyESjLQYalGI59uzmuzIGdRkB0dUj423XV8=
=4wdl
-----END PGP SIGNATURE-----