)]}'
{"id":"openstack%2Fdesignate~1000474","triplet_id":"openstack%2Fdesignate~stable%2F2025.2~I0900980fd1f2ecfba11c745762fae2f043078259","project":"openstack/designate","branch":"stable/2025.2","topic":"bug/2160533","attention_set":{},"removed_from_attention_set":{"31664":{"account":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"last_update":"2026-08-11 15:52:42.000000000","reason":"\u003cGERRIT_ACCOUNT_31664\u003e replied on the change","reason_account":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}}},"hashtags":["CVE-2026-71193","CVE-2026-71194","OSSA-2026-034"],"change_id":"I0900980fd1f2ecfba11c745762fae2f043078259","subject":"Fix cross-tenant/cross-pool zone ownership bypass","status":"MERGED","created":"2026-08-11 14:14:53.000000000","updated":"2026-08-11 17:27:05.000000000","submitted":"2026-08-11 17:26:06.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1000474-bug/2160533","meta_rev_id":"7a573008e9e9538eef60cc0c8daa71240d6eef72","_number":1000474,"virtual_id_number":1000474,"owner":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-11 17:26:06.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":2,"date":"2026-08-11 15:52:42.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-11 14:15:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":1,"date":"2026-08-11 15:52:42.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":2,"date":"2026-08-11 15:52:42.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-11 14:17:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-11 14:15:03.000000000","updated_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"reviewer":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"state":"REVIEWER"},{"updated":"2026-08-11 15:46:33.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"9d2e518a2a9d8bbe5b3846e9be043f793305cdbe","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"date":"2026-08-11 14:14:53.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c81c461dcf8e28dbfe2439532b44dc44ec5e2cbe","author":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"date":"2026-08-11 14:15:03.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"c28ae4203d5042259c6fe2784c612888a7a1e780","author":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"date":"2026-08-11 14:17:22.000000000","message":"Patch Set 1: Review-Priority+2","accounts_in_message":[],"_revision_number":1},{"id":"a3c9bc50e8d6b0bded5f2411e0a4de3d65e1ce0a","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-11 14:35:43.000000000","message":"Topic set to bug/2160533","accounts_in_message":[],"_revision_number":1},{"id":"6e1c599b25b4c729d606e8f124493eeee2a4b9e6","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-11 14:56:17.000000000","message":"Hashtags added: CVE-2026-71193, CVE-2026-71194, OSSA-2026-034","accounts_in_message":[],"_revision_number":1},{"id":"68c5d8c53f9eef9cd18745c967492a945bb7bfdc","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 15:46:33.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/75321146050148e0ac795087f0ca7e54\n\n- designate-grenade-bind9 https://zuul.opendev.org/t/openstack/build/62bad1e97a684205bed59c08b6db86cd : SUCCESS in 1h 21m 02s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/d525018f33b545bfa83c36954cb8118e : SUCCESS in 1h 11m 58s\n- designate-grenade-bind9-skip-level https://zuul.opendev.org/t/openstack/build/7cf0aae5a3094abea6fb800e49b89ccc : FAILURE in 30m 03s (non-voting)\n- designate-grenade-pdns4-skip-level https://zuul.opendev.org/t/openstack/build/9a05c41687564377815a7aa67dc3e926 : FAILURE in 59m 26s (non-voting)\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/0ec9b265fee646da9777aee665e4f4c9 : SUCCESS in 6m 55s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/97275353b73c4f308e93f0e7e69f19e5 : SUCCESS in 3m 40s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/bf22bb782cc543c7b656c7edd3bddf9d : SUCCESS in 4m 16s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/30571c7b12814f808a225d261fa52f06 : SUCCESS in 5m 52s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/700420aff2f346818fe48b92411eb583 : SUCCESS in 7m 19s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fb180e748a09496c8c824c162c6f5a61 : SUCCESS in 10m 42s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/df23bd322dbc4f3a8121b8189a300b43 : SUCCESS in 8m 01s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/97547b3a9c70434c85e0c0678f9d80c8 : SUCCESS in 34m 37s\n- designate-tox-dnspython-latest https://zuul.opendev.org/t/openstack/build/c825bac135484fbabbac134c51025be9 : SUCCESS in 5m 39s","accounts_in_message":[],"_revision_number":1},{"id":"2ea3d6c3c05a6da12656954cab489e5a6e4fe001","author":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"date":"2026-08-11 15:52:42.000000000","message":"Patch Set 1: Code-Review+2 Review-Priority+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"bd0caee9ed136111d595ce085f2742377874cbe5","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 15:53:17.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"229e225ba45a09f286e58d063fa3154d6f23686b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:26:06.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/42ca7c1603f148b38f4612f80f105c76\n\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/2adc5dd18950413d9a7304876665f4c7 : SUCCESS in 1h 15m 29s\n- designate-grenade-bind9 https://zuul.opendev.org/t/openstack/build/4c7885f8c69d4ef0b266b008f6a7e6a2 : SUCCESS in 1h 26m 40s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9b58b414c2b149ae8682fda80a9581db : SUCCESS in 3m 42s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/5dc63ffa47dc4c348e85f112c1870883 : SUCCESS in 5m 19s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/aed4f27947514268ad92fe34d490770b : SUCCESS in 4m 59s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/978d538746e440438b756bbd9a7013fd : SUCCESS in 9m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/554bdc9b79864c1c8539b3692f2bde97 : SUCCESS in 2m 58s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/eb93729e25c54e968dc8c0756bb31eef : SUCCESS in 32m 06s","accounts_in_message":[],"_revision_number":1},{"id":"91f3d01784d348790cc9cb6ed3d1653e78afb4eb","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:26:06.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"7a573008e9e9538eef60cc0c8daa71240d6eef72","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:27:05.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e993ba3f06db48e89ea30f84d1a06744\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/559f20700a4d40c6a8203b02115f9363 : SUCCESS in 49s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"2ee5e4a00bc632283a4b5c5da1a94d8f184d1272","revisions":{"2ee5e4a00bc632283a4b5c5da1a94d8f184d1272":{"kind":"REWORK","_number":1,"created":"2026-08-11 14:14:53.000000000","uploader":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"ref":"refs/changes/74/1000474/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/74/1000474/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/74/1000474/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/74/1000474/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/74/1000474/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/74/1000474/1"}}},"commit":{"parents":[{"commit":"ef31c9598371471d0e91986c968a1dd85c64746c","subject":"Require TSIG keys for zones in non-default pools","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/ef31c9598371471d0e91986c968a1dd85c64746c"}]}],"author":{"name":"Omer","email":"oschwart@redhat.com","date":"2026-07-23 10:32:31.000000000","tz":120},"committer":{"name":"Omer","email":"oschwart@redhat.com","date":"2026-08-11 14:14:45.000000000","tz":120},"subject":"Fix cross-tenant/cross-pool zone ownership bypass","message":"Fix cross-tenant/cross-pool zone ownership bypass\n\nZone ownership checks (duplicate-name, subzone, superzone) and mDNS\nrecord/NOTIFY lookups only ever considered the zone\u0027s own pool, so a\ntenant could bypass all three ownership protections against another\ntenant\u0027s zone by scheduling to a different pool, and could trigger an\nambiguous-lookup DoS in mDNS via a colliding zone name in another pool.\n\nAdd _check_zone_ownership_conflicts(), called from create_zone() before\npool scheduling, which searches for exact-name/subzone/superzone\nconflicts across all pools and rejects them only when the conflicting\nzone belongs to a different tenant. Same-tenant use of an identical or\noverlapping name across pools (split-horizon, pool migrations) is\npreserved unchanged.\n\nFix the two unscoped mDNS lookups this bypass made exploitable:\n_handle_record_query() now walks from the query name up through its\nancestors, scoping each candidate by the TSIG-derived (or default)\npool_id, with no remaining unscoped fallback. _handle_notify() now\nfetches every zone matching the name and disambiguates using the trust\ncheck it already performs - whether the sending IP is a configured\nmaster for that zone - since NOTIFY has no TSIG relationship to scope\nby.\n\nCloses-Bug: #2160533\nChange-Id: I0900980fd1f2ecfba11c745762fae2f043078259\nSigned-off-by: Omer \u003coschwart@redhat.com\u003e\n(cherry picked from commit 7f7adaea0d5246ae3cabb1a5cd4e90de6e6904ba)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/2ee5e4a00bc632283a4b5c5da1a94d8f184d1272"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/2ee5e4a00bc632283a4b5c5da1a94d8f184d1272"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}},{"label":"Review-Priority","status":"MAY","applied_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}