)]}'
{"id":"openstack%2Fsecurity-doc~1002410","triplet_id":"openstack%2Fsecurity-doc~master~I06c3d9061a8779549fd301d913c4a6ccf8869bfd","project":"openstack/security-doc","branch":"master","attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-10-12 12:00:33.000000000","reason":"Change was marked ready for review"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 17:23:33.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"removed_from_attention_set":{"10342":{"account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"last_update":"2026-09-04 18:05:29.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"hashtags":[],"change_id":"I06c3d9061a8779549fd301d913c4a6ccf8869bfd","subject":"OSSN-0114: Self-service password change does not revoke generators","status":"NEW","created":"2026-08-25 23:23:55.000000000","updated":"2026-10-12 12:15:47.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":3,"unresolved_comment_count":1,"has_review_started":true,"meta_rev_id":"78952065d5b52322af6f2455d4b6a1de3c663580","_number":1002410,"virtual_id_number":1002410,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-10-12 12:15:47.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 23:29:30.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-27 17:23:33.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"state":"CC"},{"updated":"2026-09-04 15:22:57.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"bcac0bd7c00bbef0f0ca709082df9e33ffc0021c","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:23:55.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"fb5d81b7ee073e36a8d158ef252b36cf026d1579","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:29:30.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/38d6978d599a4a749a0cf1dfff7b452c\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/620b30b2029a4fb3bfb8034d80d6900d : SUCCESS in 3m 37s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/4e1a51c72c5341f988828a18e2e81768 : SUCCESS in 4m 02s","accounts_in_message":[],"_revision_number":1},{"id":"4659a986383b60a07c54069ef805de729b5b2a2d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:31:24.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"e41a0a8ef012122d198210811883a1b1999ef2f8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:36:18.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/212520d4d9ca4c75a0b8b6e63ded2552\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0592db1599ff4365971cdc289e742832 : SUCCESS in 3m 09s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/d42cc6cae9e14a0ca4356b902e5f636d : SUCCESS in 3m 00s","accounts_in_message":[],"_revision_number":2},{"id":"b35c598b5452f8b033fcc8106d9dcfe5eaa5b534","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:38:31.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"99984b54eca6c205341f69a21ad11bcf090a3a5b","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:41:51.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"678f7c720df6194793ce8fce24717bcf13ef4de8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:48:14.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/080b8c7dfc6b42679eb228c7c911635f\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/9361a62772364366a3d9a500553b13a3 : SUCCESS in 2m 09s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/8365ae94618a48e18d08c2ce1498960d : SUCCESS in 2m 41s","accounts_in_message":[],"_revision_number":4},{"id":"3d30586041ad72ca8da2dc426fe35e447f63bf9b","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:16:53.000000000","message":"Patch Set 5: Commit message was updated.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":5},{"id":"833e431645c1d32c8d42e69ec49c5b3ad1a83fa1","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:17:20.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":5},{"id":"dc026e37951eed979bd6b655facbe08a5340a6d9","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:22:50.000000000","message":"Uploaded patch set 6.","accounts_in_message":[],"_revision_number":6},{"id":"4079a270808ab9b2bab5b612d777041bae0c698d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:30:48.000000000","message":"Uploaded patch set 7.","accounts_in_message":[],"_revision_number":7},{"id":"bbc55ce5eb1f7085622e1a793233f3910ff90aee","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 12:30:49.000000000","message":"Patch Set 6: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8c97af79700f4a4b9decbb15404dd854\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0d0268166c074f4ab6c6d09e60a945a2 : SUCCESS in 2m 37s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/ea1dd2165e55415983a0db98e1874228 : SUCCESS in 2m 44s","accounts_in_message":[],"_revision_number":6},{"id":"a980540ef9d374739aec2a10178f35b0fec3f112","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:32:48.000000000","message":"Uploaded patch set 8.","accounts_in_message":[],"_revision_number":8},{"id":"19e4e0d6fde09f571d9a4a733177b024ebeff183","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:37:45.000000000","message":"Patch Set 6:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":6},{"id":"2ffd17e16851b741497ea06e4a67eafcab1f17ea","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:37:45.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":8},{"id":"5c0e3b2cc1e497b620438cb461f2cf8cac7242c5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 12:41:13.000000000","message":"Patch Set 8: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/026e8b08c3ea45939dcc9b18eb221db9\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0d045443669e4c1ea2fdb6dbe0155c8a : SUCCESS in 2m 06s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/75755ef4d8fb421294297a438bd624da : SUCCESS in 2m 56s","accounts_in_message":[],"_revision_number":8},{"id":"dac420d9c67ca99a276b29d085074d375fa6354b","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:41:19.000000000","message":"Patch Set 8:\n\n(1 comment)","accounts_in_message":[],"_revision_number":8},{"id":"1a31620da19939ae2c6b40dbd6e079051ce265f1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:22:51.000000000","message":"Uploaded patch set 9.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":9},{"id":"5e7a28ad52ee60123f9f89f60bda9be96ab10850","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:23:33.000000000","message":"Patch Set 9:\n\n(1 comment)","accounts_in_message":[],"_revision_number":9},{"id":"443f4cc9db7db54fbdc8ee9d018588804221972f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 17:34:38.000000000","message":"Patch Set 9: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f73c0faa335548f087c1940dc1b9b840\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/edf9d5e411544b41b12aec3d27428f3f : SUCCESS in 4m 36s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/eca66357a826499bbc1e78d25aeb6e69 : SUCCESS in 3m 09s","accounts_in_message":[],"_revision_number":9},{"id":"659c14650245ae4382cfb3065c32e134e62a1712","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-09-04 15:22:57.000000000","message":"Patch Set 9: Code-Review+2","accounts_in_message":[],"_revision_number":9},{"id":"60c72669542f032268189d4ec73ac1d4f3c774a9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-09-04 18:05:26.000000000","message":"Patch Set 10: Patch Set 9 was rebased\n\nCopied Votes:\n* Code-Review+2 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":10},{"id":"29c54f1271f230c7eb0a0cbd5ec70959e4cb3248","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-09-04 18:05:29.000000000","message":"Patch Set 10:\n\n(1 comment)","accounts_in_message":[],"_revision_number":10},{"id":"f46780b5ce1098a15128899483e7d37823272a5f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-04 18:09:18.000000000","message":"Patch Set 10: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ccf09078928b438997fad00bf7449455\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/4826cab6b1b8479db6a2bcbcf24c2ed3 : SUCCESS in 2m 29s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/af5f7f7c34bb42a992f4de5e2d06aa78 : SUCCESS in 3m 03s","accounts_in_message":[],"_revision_number":10},{"id":"916ce7a8fddc3451fd77a676f8d0098beadd9668","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-10-12 11:58:12.000000000","message":"Uploaded patch set 11.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":11},{"id":"1d75c65344b25c4d63934ad0ad0ebd96034e139e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-10-12 12:00:33.000000000","message":"Uploaded patch set 12: Commit message was updated.","accounts_in_message":[],"_revision_number":12},{"id":"a7672d9a9bd33ab335ebdc7e0726610c4c1e6130","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-10-12 12:02:30.000000000","message":"Uploaded patch set 13: Commit message was updated.","accounts_in_message":[],"_revision_number":13},{"id":"539999b5c927769e29c67213d878733238cf1965","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-10-12 12:07:07.000000000","message":"Uploaded patch set 14: Commit message was updated.","accounts_in_message":[],"_revision_number":14},{"id":"78952065d5b52322af6f2455d4b6a1de3c663580","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-12 12:15:47.000000000","message":"Patch Set 14: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/fd03ea5aab63478886d9ec29a1037d4f\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/dbcefb11464249d883d10d6b4f490074 : SUCCESS in 2m 48s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/b16778e05a9949499e23b329f1ff5dc7 : SUCCESS in 3m 08s","accounts_in_message":[],"_revision_number":14}],"current_revision_number":14,"current_revision":"70c12ae11c4fbc1a1c19aac804cc36ddac8d3de3","revisions":{"0190846ee34035cf1acce8be06fb482b0b45160f":{"kind":"REWORK","_number":1,"created":"2026-08-25 23:23:55.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/0190846ee34035cf1acce8be06fb482b0b45160f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/0190846ee34035cf1acce8be06fb482b0b45160f"}]},"branch":"refs/heads/master"},"b1134f47ab5ac4786266fc5bfe633d11ee9117c5":{"kind":"REWORK","_number":2,"created":"2026-08-25 23:31:24.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:31:22.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b1134f47ab5ac4786266fc5bfe633d11ee9117c5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b1134f47ab5ac4786266fc5bfe633d11ee9117c5"}]},"branch":"refs/heads/master"},"b6515eff2d7ca9b201a08bbe2b344b0792965d4e":{"kind":"REWORK","_number":3,"created":"2026-08-25 23:38:31.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:38:28.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b6515eff2d7ca9b201a08bbe2b344b0792965d4e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b6515eff2d7ca9b201a08bbe2b344b0792965d4e"}]},"branch":"refs/heads/master"},"e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498":{"kind":"REWORK","_number":4,"created":"2026-08-25 23:41:51.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:41:49.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498"}]},"branch":"refs/heads/master"},"c3ff68a1857f4b6e430678e11616a20a9148d5be":{"kind":"NO_CODE_CHANGE","_number":5,"created":"2026-08-26 12:16:53.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:16:53.000000000","tz":0},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/c3ff68a1857f4b6e430678e11616a20a9148d5be"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/c3ff68a1857f4b6e430678e11616a20a9148d5be"}]},"branch":"refs/heads/master","description":"Edit commit message"},"a2205881332f7fd3ca51da88f7b06f025e780a29":{"kind":"REWORK","_number":6,"created":"2026-08-26 12:22:50.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:22:43.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/a2205881332f7fd3ca51da88f7b06f025e780a29"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/a2205881332f7fd3ca51da88f7b06f025e780a29"}]},"branch":"refs/heads/master"},"3e256edfe2808ca7d5d0c5bf066f46f3bf394105":{"kind":"REWORK","_number":7,"created":"2026-08-26 12:30:48.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:30:40.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/3e256edfe2808ca7d5d0c5bf066f46f3bf394105"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/3e256edfe2808ca7d5d0c5bf066f46f3bf394105"}]},"branch":"refs/heads/master"},"51b2a39127eb54d66937d92837b34a3cff6e1a87":{"kind":"REWORK","_number":8,"created":"2026-08-26 12:32:48.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/8","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/8","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:32:45.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/51b2a39127eb54d66937d92837b34a3cff6e1a87"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/51b2a39127eb54d66937d92837b34a3cff6e1a87"}]},"branch":"refs/heads/master"},"9e0b0c184a36fdd8587a4a7367188b30325199ce":{"kind":"REWORK","_number":9,"created":"2026-08-27 17:22:51.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/10/1002410/9","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/9","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9"}}},"commit":{"parents":[{"commit":"e08e4734ad7013adf6cffc3d7e45bb94ab0d4525","subject":"Merge \"Migrate OSSN txt files to build pipeline\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e08e4734ad7013adf6cffc3d7e45bb94ab0d4525"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2026-08-27 17:22:38.000000000","tz":-420},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e0b0c184a36fdd8587a4a7367188b30325199ce"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e0b0c184a36fdd8587a4a7367188b30325199ce"}]},"branch":"refs/heads/master"},"22b1c84a168cf8180d6cee62c3c44491837b5083":{"kind":"TRIVIAL_REBASE","_number":10,"created":"2026-09-04 18:05:26.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/10/1002410/10","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/10","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/10 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/10 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/10 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/10"}}},"commit":{"parents":[{"commit":"1cdb93778d578c9f6321ee3722817152dcfda05b","subject":"Merge \"Backfill publication dates for OSSNs; publish them\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/1cdb93778d578c9f6321ee3722817152dcfda05b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2026-09-04 18:05:26.000000000","tz":0},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/22b1c84a168cf8180d6cee62c3c44491837b5083"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/22b1c84a168cf8180d6cee62c3c44491837b5083"}]},"branch":"refs/heads/master","description":"Rebase","conflicts":{"base":"e08e4734ad7013adf6cffc3d7e45bb94ab0d4525","ours":"9e0b0c184a36fdd8587a4a7367188b30325199ce","theirs":"1cdb93778d578c9f6321ee3722817152dcfda05b","merge_strategy":"recursive","contains_conflicts":false}},"cc82a36e9b2c587e5044d135135540992218f7c9":{"kind":"REWORK","_number":11,"created":"2026-10-12 11:58:12.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/11","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/11","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/11 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/11 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/11 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/11"}}},"commit":{"parents":[{"commit":"7de09ca925a5d2ab0920196a1cc4ee5fd2763130","subject":"Merge \"OSSN-0110: Ironic image server + basic auth\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7de09ca925a5d2ab0920196a1cc4ee5fd2763130"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-10-12 11:58:10.000000000","tz":120},"subject":"OSSN-0114: password change does not revoke token generators","message":"OSSN-0114: password change does not revoke token generators\n\nRenumber from OSSN-0110 after that id was taken by the Ironic note.\nPoint the related EC2 discussion at OSSN-0112 and the assigned CVE ids\nCVE-2026-80182 and CVE-2026-80184. Set the publication date to 2026-10-13.\n\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/cc82a36e9b2c587e5044d135135540992218f7c9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/cc82a36e9b2c587e5044d135135540992218f7c9"}]},"branch":"refs/heads/master"},"cac5b95cd743d00a10665cdf782b277bfda72a6f":{"kind":"NO_CODE_CHANGE","_number":12,"created":"2026-10-12 12:00:33.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/12","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/12","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/12 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/12 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/12 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/12"}}},"commit":{"parents":[{"commit":"7de09ca925a5d2ab0920196a1cc4ee5fd2763130","subject":"Merge \"OSSN-0110: Ironic image server + basic auth\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7de09ca925a5d2ab0920196a1cc4ee5fd2763130"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-10-12 12:00:31.000000000","tz":120},"subject":"OSSN-0114: Self-service password change does not revoke generators","message":"OSSN-0114: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\n\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/cac5b95cd743d00a10665cdf782b277bfda72a6f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/cac5b95cd743d00a10665cdf782b277bfda72a6f"}]},"branch":"refs/heads/master"},"9ca88123f613420769018be6233471b9ad209b42":{"kind":"NO_CODE_CHANGE","_number":13,"created":"2026-10-12 12:02:30.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/13","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/13","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/13 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/13 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/13 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/13"}}},"commit":{"parents":[{"commit":"7de09ca925a5d2ab0920196a1cc4ee5fd2763130","subject":"Merge \"OSSN-0110: Ironic image server + basic auth\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7de09ca925a5d2ab0920196a1cc4ee5fd2763130"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-10-12 12:02:28.000000000","tz":120},"subject":"OSSN-0114: Self-service password change does not revoke generators","message":"OSSN-0114: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nCloses-Bug: #2153447\nRelated-Bug: #2129010\nRelated-Bug: #2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\n\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9ca88123f613420769018be6233471b9ad209b42"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9ca88123f613420769018be6233471b9ad209b42"}]},"branch":"refs/heads/master"},"70c12ae11c4fbc1a1c19aac804cc36ddac8d3de3":{"kind":"NO_CODE_CHANGE","_number":14,"created":"2026-10-12 12:07:07.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/14","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/14","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/14 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/14 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/14 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/14"}}},"commit":{"parents":[{"commit":"7de09ca925a5d2ab0920196a1cc4ee5fd2763130","subject":"Merge \"OSSN-0110: Ironic image server + basic auth\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7de09ca925a5d2ab0920196a1cc4ee5fd2763130"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-10-12 12:07:05.000000000","tz":120},"subject":"OSSN-0114: Self-service password change does not revoke generators","message":"OSSN-0114: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nCloses-Bug: #2153447\nRelated-Bug: #2129010\nRelated-Bug: #2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/70c12ae11c4fbc1a1c19aac804cc36ddac8d3de3"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/70c12ae11c4fbc1a1c19aac804cc36ddac8d3de3"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}