)]}'
{"id":"openstack%2Fkeystonemiddleware~973499","triplet_id":"openstack%2Fkeystonemiddleware~unmaintained%2F2024.1~Idd4fe1d17a25b3064b31f454d9830242f345e018","project":"openstack/keystonemiddleware","branch":"unmaintained/2024.1","attention_set":{},"removed_from_attention_set":{"17685":{"account":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"last_update":"2026-01-16 16:29:35.000000000","reason":"\u003cGERRIT_ACCOUNT_17685\u003e replied on the change","reason_account":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-01-16 17:46:27.000000000","reason":"Change was submitted"},"5263":{"account":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"last_update":"2026-01-16 17:46:27.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Idd4fe1d17a25b3064b31f454d9830242f345e018","subject":"Fix privilege escalation via spoofed identity headers","status":"MERGED","created":"2026-01-15 15:06:58.000000000","updated":"2026-01-16 17:47:39.000000000","submitted":"2026-01-16 17:46:27.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"973499","meta_rev_id":"cebcee64365a854d3b1543bb7c421136c430ee05","_number":973499,"virtual_id_number":973499,"owner":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-01-16 17:46:27.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":2,"date":"2026-01-16 16:29:35.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":1,"date":"2026-01-16 14:20:47.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":1,"date":"2026-01-16 16:29:35.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-01-15 15:06:58.000000000","updated_by":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-01-15 16:46:49.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-01-15 17:33:54.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-01-16 13:34:59.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"},{"updated":"2026-01-16 14:20:47.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"e87ae981225c8e4fb507fb95c786c92f151afe42","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"date":"2026-01-15 15:06:58.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"9649bc0e2c902c3b2b3c85aac492e703bfb45d01","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-15 16:46:49.000000000","message":"Patch Set 1: Verified-1\n\n(1 comment)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/4773678c2a3f46fab354005e7ee54b7c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/994252377cdf42eab6a80e438bc14aa3 : SUCCESS in 4m 16s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e8d2d99ee6e74fc0a2696ed3927a7557 : FAILURE in 4m 08s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1d93eea908344c7e928adefde89d6014 : SUCCESS in 3m 02s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d756940b91404870a433d44279911ea4 : SUCCESS in 1h 34m 43s","accounts_in_message":[],"_revision_number":1},{"id":"447036207cc4ee7454ac026562f6dd10da4e5fba","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-01-15 17:33:54.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[],"_revision_number":2},{"id":"93737f492370d41eac9e642df341c6f07c478280","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-15 19:11:29.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1181107b38f544e581bc4459e98ed725\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bdf934e27fe64d0ba3c90599983de3b4 : SUCCESS in 3m 28s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0400bd766df64fdca761c4d71dc3aeb7 : SUCCESS in 3m 13s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/56f8aa68af61472b813357a4947f879d : SUCCESS in 5m 54s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f9cc54980d5441b6a1814cc7b3c2027b : SUCCESS in 1h 35m 51s","accounts_in_message":[],"_revision_number":2},{"id":"63b29d88d7c634268f333d342fbda529fad882a8","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-01-16 14:20:47.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"899c210189b7c99579a8048743bddc5bb6086ea1","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-01-16 16:29:35.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"937a09f1271f133680bf5fad6cbe9d619b40a56a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 16:29:55.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"5ef9f9492380b0a99c0e3a85e311de6847c5dc81","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-01-16 16:32:51.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"81c18d9e79ade75e7a321a599984f9c21254bed8","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 17:46:27.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6892c3c57cf74b75b035d558c724b9d9\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7b2b248bcd27485797b1263bd828a115 : SUCCESS in 2m 43s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/68301eb696c140f3996be74fca0d361c : SUCCESS in 5m 27s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/cd94f46377e14cfd8aa836bbdda6baec : SUCCESS in 1h 15m 10s","accounts_in_message":[],"_revision_number":2},{"id":"58e8dfaa19449303adc3cd7bea51762d9f8c931e","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 17:46:27.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"cebcee64365a854d3b1543bb7c421136c430ee05","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-01-16 17:47:39.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6e55e021a40d46b99727ed6b953aa8a1\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/44d4d52dfb3e4bfbac61b6daa321a8ab : SUCCESS in 58s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"52acf50ca54b4db7f905f0d45736b6eb25ecf3b5","revisions":{"e9a0dfe17df32d9a47c6c70e69ddce7c6dcff6b7":{"kind":"REWORK","_number":1,"created":"2026-01-15 15:06:58.000000000","uploader":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"ref":"refs/changes/99/973499/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/99/973499/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/1"}}},"commit":{"parents":[{"commit":"f58418f9fe654f7d75e030893002e05bcbb22332","subject":"Update .gitreview for unmaintained/2024.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/f58418f9fe654f7d75e030893002e05bcbb22332"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-01-08 13:46:19.000000000","tz":60},"committer":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2026-01-15 15:06:51.000000000","tz":0},"subject":"Fix privilege escalation via spoofed identity headers","message":"Fix privilege escalation via spoofed identity headers\n\nThe external_oauth2_token middleware did not sanitize incoming\nauthentication headers before processing OAuth 2.0 tokens. This\nallowed an attacker to send forged identity headers (e.g.,\nX-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared\nby the middleware, potentially enabling privilege escalation.\n\nThis fix adds a call to remove_auth_headers() at the start of\nrequest processing to sanitize all incoming identity headers,\nmatching the secure behavior of the main auth_token middleware.\n\nCloses-Bug: #2129018\nChange-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018\n(cherry picked from commit b473c0ed1467b70c74c8a82cb4d15ccf8424b27b)\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/e9a0dfe17df32d9a47c6c70e69ddce7c6dcff6b7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/e9a0dfe17df32d9a47c6c70e69ddce7c6dcff6b7"}]},"branch":"refs/heads/unmaintained/2024.1"},"52acf50ca54b4db7f905f0d45736b6eb25ecf3b5":{"kind":"REWORK","_number":2,"created":"2026-01-15 17:33:54.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/99/973499/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/99/973499/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/99/973499/2"}}},"commit":{"parents":[{"commit":"f58418f9fe654f7d75e030893002e05bcbb22332","subject":"Update .gitreview for unmaintained/2024.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/f58418f9fe654f7d75e030893002e05bcbb22332"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-01-08 13:46:19.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-01-15 17:33:50.000000000","tz":60},"subject":"Fix privilege escalation via spoofed identity headers","message":"Fix privilege escalation via spoofed identity headers\n\nThe external_oauth2_token middleware did not sanitize incoming\nauthentication headers before processing OAuth 2.0 tokens. This\nallowed an attacker to send forged identity headers (e.g.,\nX-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared\nby the middleware, potentially enabling privilege escalation.\n\nThis fix adds a call to remove_auth_headers() at the start of\nrequest processing to sanitize all incoming identity headers,\nmatching the secure behavior of the main auth_token middleware.\n\nCloses-Bug: #2129018\nChange-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018\n(cherry picked from commit b473c0ed1467b70c74c8a82cb4d15ccf8424b27b)\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/52acf50ca54b4db7f905f0d45736b6eb25ecf3b5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/52acf50ca54b4db7f905f0d45736b6eb25ecf3b5"}]},"branch":"refs/heads/unmaintained/2024.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}