)]}'
{"id":"openstack%2Fkeystonemiddleware~973497","triplet_id":"openstack%2Fkeystonemiddleware~stable%2F2024.2~Idd4fe1d17a25b3064b31f454d9830242f345e018","project":"openstack/keystonemiddleware","branch":"stable/2024.2","attention_set":{},"removed_from_attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-01-16 15:54:53.000000000","reason":"Change was submitted"},"5263":{"account":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"last_update":"2026-01-16 15:54:53.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Idd4fe1d17a25b3064b31f454d9830242f345e018","subject":"Fix privilege escalation via spoofed identity headers","status":"MERGED","created":"2026-01-15 15:06:12.000000000","updated":"2026-01-16 15:55:51.000000000","submitted":"2026-01-16 15:54:53.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"973497","meta_rev_id":"f22409cc24c62babdfceaa452d40c3838b8a34d2","_number":973497,"virtual_id_number":973497,"owner":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-01-16 15:54:53.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-01-16 14:20:33.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-01-15 19:44:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-01-16 14:20:33.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-01-15 15:06:12.000000000","updated_by":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-01-15 15:33:24.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-01-15 16:58:40.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-01-16 14:20:33.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"674488c8b312391c1f2f9d728e3b12d83dbed1af","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"date":"2026-01-15 15:06:12.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4cfcfc738ee1d9981b5fc4738a034cf09500eff2","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-01-15 15:33:24.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"3e8ff7af150f6fe10f3b2920b882391b83016df6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-15 16:58:40.000000000","message":"Patch Set 1: Verified-1\n\n(1 comment)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/094ff41bae9e4a7fbff9a3314bc20e22\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/2a1b2d1f4ef94c5ea9d2fbd6b642b6ce : SUCCESS in 3m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/778e7dcd9f15425c9b8b7cb003a47ce9 : FAILURE in 2m 44s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/fc980807b1564ca89ad8743739b5f0d2 : SUCCESS in 4m 21s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/1b78351128f44057842b63db338dbea3 : SUCCESS in 5m 46s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/67c3ceeffe9e4fcaa72d9e11ecc691fc : SUCCESS in 4m 55s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c56f5d0018a04faf9a5aa64e807d1151 : SUCCESS in 7m 05s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/54a047a8ba104085a1cd89ddd310b222 : SUCCESS in 1h 46m 52s","accounts_in_message":[],"_revision_number":1},{"id":"0690ff8e88463996f1ce2133a6bbf7d7adbb470e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-01-15 17:32:31.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1\n","accounts_in_message":[],"_revision_number":2},{"id":"fa9ebcecb5e87e66591182448128190c63812a05","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-15 19:03:36.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/62acbfd259754e2a9f758645092d04f0\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bc0af657856c4bcab0f02d55fbf33d1a : SUCCESS in 5m 15s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9e6035e11b5241d69449a9efe089e474 : SUCCESS in 3m 00s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/5561b65c5b004426acf099dbc707c6d2 : SUCCESS in 6m 30s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/fdd1e2ce805043f4900e8698d79213b2 : SUCCESS in 6m 01s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/23509da2d98c44fe966a66530e09ee96 : SUCCESS in 4m 54s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/db91b95fc7ae4068b29c1f3d9a9f4d8f : SUCCESS in 6m 07s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/1f226cf7573b49e08025f03749691210 : SUCCESS in 1h 22m 10s","accounts_in_message":[],"_revision_number":2},{"id":"ae1e8084f3783be32cf4898954c447d98caa4374","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-01-15 19:44:22.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"84255991f7e04500bcb7a9c5a51f9b1f8a837916","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-01-16 14:20:33.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"5cecf0e993c0ecdd59def18814f55bd3c21682c3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 14:21:02.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"9ec6df7eb875ca80418ed4a2056bcb21a0359608","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 15:54:53.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d4030b1dc162413ca302e89cfdbd01e7\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ba694efdb3894d43ba69001de4034cf1 : SUCCESS in 3m 17s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/96670b05ba3647949bb95ef39dbcf859 : SUCCESS in 2m 05s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/bc093cc99f044983a956612a93713eee : SUCCESS in 2m 52s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6813216b54bf4947902eb14611d9402d : SUCCESS in 5m 22s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/40754a36071a4665a0af8d8deaa854c9 : SUCCESS in 1h 29m 08s","accounts_in_message":[],"_revision_number":2},{"id":"3b596ec23e7167269636c743969df99a55b9425d","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 15:54:53.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"f22409cc24c62babdfceaa452d40c3838b8a34d2","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 15:55:51.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/99edeb7ceb2a4e4182d2df276b7e443a\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1c35eced1a944f1fafc5669c945f80b2 : SUCCESS in 50s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"1503baabd15606668104c5d6633030b91e8d395d","revisions":{"cca0c6969d31a65ede950436f02cb9513ed30300":{"kind":"REWORK","_number":1,"created":"2026-01-15 15:06:12.000000000","uploader":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"ref":"refs/changes/97/973497/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/97/973497/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/1"}}},"commit":{"parents":[{"commit":"6b6a263d8ee1feae163565eaaef13195bece4f4a","subject":"Update TOX_CONSTRAINTS_FILE for stable/2024.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/6b6a263d8ee1feae163565eaaef13195bece4f4a"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-01-08 13:46:19.000000000","tz":60},"committer":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2026-01-15 15:06:05.000000000","tz":0},"subject":"Fix privilege escalation via spoofed identity headers","message":"Fix privilege escalation via spoofed identity headers\n\nThe external_oauth2_token middleware did not sanitize incoming\nauthentication headers before processing OAuth 2.0 tokens. This\nallowed an attacker to send forged identity headers (e.g.,\nX-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared\nby the middleware, potentially enabling privilege escalation.\n\nThis fix adds a call to remove_auth_headers() at the start of\nrequest processing to sanitize all incoming identity headers,\nmatching the secure behavior of the main auth_token middleware.\n\nCloses-Bug: #2129018\nChange-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018\n(cherry picked from commit b473c0ed1467b70c74c8a82cb4d15ccf8424b27b)\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/cca0c6969d31a65ede950436f02cb9513ed30300"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/cca0c6969d31a65ede950436f02cb9513ed30300"}]},"branch":"refs/heads/stable/2024.2"},"1503baabd15606668104c5d6633030b91e8d395d":{"kind":"REWORK","_number":2,"created":"2026-01-15 17:32:31.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/97/973497/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/97/973497/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/97/973497/2"}}},"commit":{"parents":[{"commit":"6b6a263d8ee1feae163565eaaef13195bece4f4a","subject":"Update TOX_CONSTRAINTS_FILE for stable/2024.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/6b6a263d8ee1feae163565eaaef13195bece4f4a"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-01-08 13:46:19.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-01-15 17:32:22.000000000","tz":60},"subject":"Fix privilege escalation via spoofed identity headers","message":"Fix privilege escalation via spoofed identity headers\n\nThe external_oauth2_token middleware did not sanitize incoming\nauthentication headers before processing OAuth 2.0 tokens. This\nallowed an attacker to send forged identity headers (e.g.,\nX-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared\nby the middleware, potentially enabling privilege escalation.\n\nThis fix adds a call to remove_auth_headers() at the start of\nrequest processing to sanitize all incoming identity headers,\nmatching the secure behavior of the main auth_token middleware.\n\nCloses-Bug: #2129018\nChange-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018\n(cherry picked from commit b473c0ed1467b70c74c8a82cb4d15ccf8424b27b)\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/1503baabd15606668104c5d6633030b91e8d395d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/1503baabd15606668104c5d6633030b91e8d395d"}]},"branch":"refs/heads/stable/2024.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}