)]}'
{"id":"openstack%2Fdesignate~1000475","triplet_id":"openstack%2Fdesignate~stable%2F2025.1~I0900980fd1f2ecfba11c745762fae2f043078259","project":"openstack/designate","branch":"stable/2025.1","topic":"bug/2160533","attention_set":{},"removed_from_attention_set":{"31664":{"account":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"last_update":"2026-08-11 15:52:46.000000000","reason":"\u003cGERRIT_ACCOUNT_31664\u003e replied on the change","reason_account":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}}},"hashtags":["CVE-2026-71193","CVE-2026-71194","OSSA-2026-034"],"change_id":"I0900980fd1f2ecfba11c745762fae2f043078259","subject":"Fix cross-tenant/cross-pool zone ownership bypass","status":"MERGED","created":"2026-08-11 14:15:19.000000000","updated":"2026-08-11 17:27:03.000000000","submitted":"2026-08-11 17:26:09.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1000475-bug/2160533","meta_rev_id":"5bb7cefa26d0c44ace28afae4caf2f31160407cf","_number":1000475,"virtual_id_number":1000475,"owner":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-11 17:26:08.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":2,"date":"2026-08-11 15:52:46.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-11 14:15:25.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":1,"date":"2026-08-11 15:52:46.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"approved":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"all":[{"value":2,"date":"2026-08-11 15:52:46.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-11 14:17:25.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-11 14:15:25.000000000","updated_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"reviewer":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"state":"REVIEWER"},{"updated":"2026-08-11 15:16:59.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"d0b724beb02c06b4f50667fed9cd2973eef3807b","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"date":"2026-08-11 14:15:19.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"2d4ae7ee9089e3c60522c1aaa918a089870df55b","author":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"date":"2026-08-11 14:15:25.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"28d8216c3dce9cff0876beb973541eacef6d6244","author":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"date":"2026-08-11 14:17:25.000000000","message":"Patch Set 1: Review-Priority+2","accounts_in_message":[],"_revision_number":1},{"id":"9cdc20828be392c3b48dce6b5355ffa2ecba22a6","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-11 14:35:50.000000000","message":"Topic set to bug/2160533","accounts_in_message":[],"_revision_number":1},{"id":"3510638d9dd130cd61ade8be082c731cd0e9155f","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-11 14:56:17.000000000","message":"Hashtags added: CVE-2026-71193, CVE-2026-71194, OSSA-2026-034","accounts_in_message":[],"_revision_number":1},{"id":"1fc1982847db381913f879e33210515cc5f80fb0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 15:16:59.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3481c4356ebc46e59158c1d0693e7ffa\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/3e011600974c4ab8bba496a91f05faf7 : SUCCESS in 45m 30s\n- designate-bind9-centos9stream-fips https://zuul.opendev.org/t/openstack/build/cb4f0345819a477bbd78bf44b8a79934 : FAILURE in 31m 52s (non-voting)\n- designate-bind9-centos-9-stream https://zuul.opendev.org/t/openstack/build/654586dea0b341699953d8268bc05c84 : FAILURE in 12m 59s (non-voting)\n- designate-bind9-keystone-old-default-roles https://zuul.opendev.org/t/openstack/build/1f7a5ed030b14123857553a12b8401ed : SUCCESS in 50m 29s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/3fcb79488ce144719523456dca6b8b5c : SUCCESS in 47m 39s\n- designate-grenade-bind9 https://zuul.opendev.org/t/openstack/build/a131fd49053d429a93dd306b1b163f7d : FAILURE in 21m 15s (non-voting)\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/66490dfc9a63467284e5c2fb2ae8d079 : FAILURE in 26m 36s (non-voting)\n- designate-grenade-bind9-skip-level https://zuul.opendev.org/t/openstack/build/22dd989532904ae6b75161b9f4c30bf4 : FAILURE in 16m 53s (non-voting)\n- designate-grenade-pdns4-skip-level https://zuul.opendev.org/t/openstack/build/75de862cc9464d1b8409f7d80f4e193d : FAILURE in 17m 09s (non-voting)\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/0e49c7a36e944b3486ee9a4da736c86f : SUCCESS in 44m 58s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/8976bff7d45d461393029adaf18a2c56 : SUCCESS in 51m 09s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/de370f378dfd4b5a8ef0c21d63452a62 : SUCCESS in 7m 52s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f3f7fbdef175456680382278933d97b3 : SUCCESS in 3m 51s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e0fdfba0141747eba0334122faef5fbd : SUCCESS in 8m 27s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/611ac3802cc24b14882ed659d7b4efe1 : SUCCESS in 6m 36s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a06c8fb90cff4e85bc21d008bfbe31d4 : SUCCESS in 9m 49s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/337d8be5787a4efc8d6b9a6f29353d52 : SUCCESS in 6m 03s\n- neutron-tempest-plugin-designate-scenario-2025-1 https://zuul.opendev.org/t/openstack/build/0a63436c76774668947e5cc974255cf1 : SUCCESS in 34m 56s\n- designate-tox-dnspython-latest https://zuul.opendev.org/t/openstack/build/931d39bb6ff7457b8bfd89ee2a42dc83 : SUCCESS in 6m 10s (non-voting)\n- designate-bind9-catalog-zones https://zuul.opendev.org/t/openstack/build/3916dba97e6240d1884138fafc2c8941 : FAILURE in 48m 40s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job designate-bind9-centos9stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job designate-bind9-centos9stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"fa6fde7bf8de4733998e6009edbd2b89b3b1e055","author":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"date":"2026-08-11 15:52:46.000000000","message":"Patch Set 1: Code-Review+2 Review-Priority+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"dc2be99d009bb2d25738f366848d93372782f1c0","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 15:53:23.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"d7365bbd09eab7ee2ab84c75802e5ead7003fc47","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:26:08.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/781d83dadbba474095570db72245d494\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/f9c5ec4effda485db417ded3f92dad1b : SUCCESS in 47m 36s\n- designate-bind9-keystone-old-default-roles https://zuul.opendev.org/t/openstack/build/cf1d195dc12e4470a829f4df94e30c39 : SUCCESS in 49m 33s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/6668989785874dbf971048a4511dbfd4 : SUCCESS in 47m 07s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/184a80d556ad4b47bb4948a986651949 : FAILURE in 17m 28s (non-voting)\n- designate-grenade-pdns4-skip-level https://zuul.opendev.org/t/openstack/build/6d08fbb4f6924d1badfaf1d180b2fd54 : FAILURE in 23m 12s (non-voting)\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/84fc0095fa2142618c59b7f2acb91ab5 : SUCCESS in 49m 14s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/98d4529df2a64eb0a3420079cece5824 : SUCCESS in 49m 08s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/58c098dde14d476693811b005a5bf369 : SUCCESS in 3m 57s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/daac0080a8b14e2e93df2efe22a55730 : SUCCESS in 4m 30s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4f008e0e1b544e66ada4e6c01e6fa94a : SUCCESS in 5m 00s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4e39def79f9d45b28392b919686b740e : SUCCESS in 8m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/19ba1e14bfea4848a90e428a0912edf6 : SUCCESS in 6m 48s\n- neutron-tempest-plugin-designate-scenario-2025-1 https://zuul.opendev.org/t/openstack/build/228a26c2702d4956be446a2192a02c81 : SUCCESS in 32m 35s","accounts_in_message":[],"_revision_number":1},{"id":"ea46aecba434f49b4d178c3b379f81c31ceb92ba","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:26:09.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"5bb7cefa26d0c44ace28afae4caf2f31160407cf","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-11 17:27:03.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/af6fbeb2d3224597bdab7c8098ff998b\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a75dcddfe3864d239441f1e4deddb92a : SUCCESS in 41s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"b5255cf54363bdb0775b51cc0fbf38eeb28aecae","revisions":{"b5255cf54363bdb0775b51cc0fbf38eeb28aecae":{"kind":"REWORK","_number":1,"created":"2026-08-11 14:15:19.000000000","uploader":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"},"ref":"refs/changes/75/1000475/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/75/1000475/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/75/1000475/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/75/1000475/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/75/1000475/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/75/1000475/1"}}},"commit":{"parents":[{"commit":"15f5db678cec792cb5421659e25cfeb35d64817a","subject":"Require TSIG keys for zones in non-default pools","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/15f5db678cec792cb5421659e25cfeb35d64817a"}]}],"author":{"name":"Omer","email":"oschwart@redhat.com","date":"2026-07-23 10:31:13.000000000","tz":120},"committer":{"name":"Omer","email":"oschwart@redhat.com","date":"2026-08-11 14:15:13.000000000","tz":120},"subject":"Fix cross-tenant/cross-pool zone ownership bypass","message":"Fix cross-tenant/cross-pool zone ownership bypass\n\nZone ownership checks (duplicate-name, subzone, superzone) and mDNS\nrecord/NOTIFY lookups only ever considered the zone\u0027s own pool, so a\ntenant could bypass all three ownership protections against another\ntenant\u0027s zone by scheduling to a different pool, and could trigger an\nambiguous-lookup DoS in mDNS via a colliding zone name in another pool.\n\nAdd _check_zone_ownership_conflicts(), called from create_zone() before\npool scheduling, which searches for exact-name/subzone/superzone\nconflicts across all pools and rejects them only when the conflicting\nzone belongs to a different tenant. Same-tenant use of an identical or\noverlapping name across pools (split-horizon, pool migrations) is\npreserved unchanged.\n\nFix the two unscoped mDNS lookups this bypass made exploitable:\n_handle_record_query() now walks from the query name up through its\nancestors, scoping each candidate by the TSIG-derived (or default)\npool_id, with no remaining unscoped fallback. _handle_notify() now\nfetches every zone matching the name and disambiguates using the trust\ncheck it already performs - whether the sending IP is a configured\nmaster for that zone - since NOTIFY has no TSIG relationship to scope\nby.\n\nCloses-Bug: #2160533\nChange-Id: I0900980fd1f2ecfba11c745762fae2f043078259\nSigned-off-by: Omer \u003coschwart@redhat.com\u003e\n(cherry picked from commit 7f7adaea0d5246ae3cabb1a5cd4e90de6e6904ba)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/b5255cf54363bdb0775b51cc0fbf38eeb28aecae"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/b5255cf54363bdb0775b51cc0fbf38eeb28aecae"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}},{"label":"Review-Priority","status":"MAY","applied_by":{"_account_id":31664,"name":"Omer Schwartz","email":"oschwart@redhat.com","username":"oschwart"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}