)]}'
{"id":"openstack%2Fsecurity-doc~1002410","triplet_id":"openstack%2Fsecurity-doc~master~I06c3d9061a8779549fd301d913c4a6ccf8869bfd","project":"openstack/security-doc","branch":"master","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 17:23:33.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I06c3d9061a8779549fd301d913c4a6ccf8869bfd","subject":"OSSN-0110: Self-service password change does not revoke generators","status":"NEW","created":"2026-08-25 23:23:55.000000000","updated":"2026-08-27 17:34:38.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":2,"unresolved_comment_count":1,"has_review_started":true,"meta_rev_id":"443f4cc9db7db54fbdc8ee9d018588804221972f","_number":1002410,"virtual_id_number":1002410,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-27 17:34:38.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 23:29:30.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-27 17:23:33.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"state":"CC"}],"messages":[{"id":"bcac0bd7c00bbef0f0ca709082df9e33ffc0021c","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:23:55.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"fb5d81b7ee073e36a8d158ef252b36cf026d1579","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:29:30.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/38d6978d599a4a749a0cf1dfff7b452c\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/620b30b2029a4fb3bfb8034d80d6900d : SUCCESS in 3m 37s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/4e1a51c72c5341f988828a18e2e81768 : SUCCESS in 4m 02s","accounts_in_message":[],"_revision_number":1},{"id":"4659a986383b60a07c54069ef805de729b5b2a2d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:31:24.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"e41a0a8ef012122d198210811883a1b1999ef2f8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:36:18.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/212520d4d9ca4c75a0b8b6e63ded2552\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0592db1599ff4365971cdc289e742832 : SUCCESS in 3m 09s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/d42cc6cae9e14a0ca4356b902e5f636d : SUCCESS in 3m 00s","accounts_in_message":[],"_revision_number":2},{"id":"b35c598b5452f8b033fcc8106d9dcfe5eaa5b534","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:38:31.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"99984b54eca6c205341f69a21ad11bcf090a3a5b","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:41:51.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"678f7c720df6194793ce8fce24717bcf13ef4de8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:48:14.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/080b8c7dfc6b42679eb228c7c911635f\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/9361a62772364366a3d9a500553b13a3 : SUCCESS in 2m 09s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/8365ae94618a48e18d08c2ce1498960d : SUCCESS in 2m 41s","accounts_in_message":[],"_revision_number":4},{"id":"3d30586041ad72ca8da2dc426fe35e447f63bf9b","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:16:53.000000000","message":"Patch Set 5: Commit message was updated.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":5},{"id":"833e431645c1d32c8d42e69ec49c5b3ad1a83fa1","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:17:20.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":5},{"id":"dc026e37951eed979bd6b655facbe08a5340a6d9","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:22:50.000000000","message":"Uploaded patch set 6.","accounts_in_message":[],"_revision_number":6},{"id":"4079a270808ab9b2bab5b612d777041bae0c698d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:30:48.000000000","message":"Uploaded patch set 7.","accounts_in_message":[],"_revision_number":7},{"id":"bbc55ce5eb1f7085622e1a793233f3910ff90aee","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 12:30:49.000000000","message":"Patch Set 6: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8c97af79700f4a4b9decbb15404dd854\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0d0268166c074f4ab6c6d09e60a945a2 : SUCCESS in 2m 37s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/ea1dd2165e55415983a0db98e1874228 : SUCCESS in 2m 44s","accounts_in_message":[],"_revision_number":6},{"id":"a980540ef9d374739aec2a10178f35b0fec3f112","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:32:48.000000000","message":"Uploaded patch set 8.","accounts_in_message":[],"_revision_number":8},{"id":"19e4e0d6fde09f571d9a4a733177b024ebeff183","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:37:45.000000000","message":"Patch Set 6:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":6},{"id":"2ffd17e16851b741497ea06e4a67eafcab1f17ea","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:37:45.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":8},{"id":"5c0e3b2cc1e497b620438cb461f2cf8cac7242c5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 12:41:13.000000000","message":"Patch Set 8: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/026e8b08c3ea45939dcc9b18eb221db9\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/0d045443669e4c1ea2fdb6dbe0155c8a : SUCCESS in 2m 06s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/75755ef4d8fb421294297a438bd624da : SUCCESS in 2m 56s","accounts_in_message":[],"_revision_number":8},{"id":"dac420d9c67ca99a276b29d085074d375fa6354b","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 12:41:19.000000000","message":"Patch Set 8:\n\n(1 comment)","accounts_in_message":[],"_revision_number":8},{"id":"1a31620da19939ae2c6b40dbd6e079051ce265f1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:22:51.000000000","message":"Uploaded patch set 9.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":9},{"id":"5e7a28ad52ee60123f9f89f60bda9be96ab10850","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:23:33.000000000","message":"Patch Set 9:\n\n(1 comment)","accounts_in_message":[],"_revision_number":9},{"id":"443f4cc9db7db54fbdc8ee9d018588804221972f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 17:34:38.000000000","message":"Patch Set 9: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f73c0faa335548f087c1940dc1b9b840\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/edf9d5e411544b41b12aec3d27428f3f : SUCCESS in 4m 36s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/eca66357a826499bbc1e78d25aeb6e69 : SUCCESS in 3m 09s","accounts_in_message":[],"_revision_number":9}],"current_revision_number":9,"current_revision":"9e0b0c184a36fdd8587a4a7367188b30325199ce","revisions":{"0190846ee34035cf1acce8be06fb482b0b45160f":{"kind":"REWORK","_number":1,"created":"2026-08-25 23:23:55.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/1"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/0190846ee34035cf1acce8be06fb482b0b45160f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/0190846ee34035cf1acce8be06fb482b0b45160f"}]},"branch":"refs/heads/master"},"b1134f47ab5ac4786266fc5bfe633d11ee9117c5":{"kind":"REWORK","_number":2,"created":"2026-08-25 23:31:24.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/2"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:31:22.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b1134f47ab5ac4786266fc5bfe633d11ee9117c5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b1134f47ab5ac4786266fc5bfe633d11ee9117c5"}]},"branch":"refs/heads/master"},"b6515eff2d7ca9b201a08bbe2b344b0792965d4e":{"kind":"REWORK","_number":3,"created":"2026-08-25 23:38:31.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/3"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:38:28.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b6515eff2d7ca9b201a08bbe2b344b0792965d4e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/b6515eff2d7ca9b201a08bbe2b344b0792965d4e"}]},"branch":"refs/heads/master"},"e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498":{"kind":"REWORK","_number":4,"created":"2026-08-25 23:41:51.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/4"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:41:49.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering LP#2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e2f8ec2c540c1d0fa17f624e6bce17bf28f7b498"}]},"branch":"refs/heads/master"},"c3ff68a1857f4b6e430678e11616a20a9148d5be":{"kind":"NO_CODE_CHANGE","_number":5,"created":"2026-08-26 12:16:53.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/5"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:16:53.000000000","tz":0},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/c3ff68a1857f4b6e430678e11616a20a9148d5be"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/c3ff68a1857f4b6e430678e11616a20a9148d5be"}]},"branch":"refs/heads/master","description":"Edit commit message"},"a2205881332f7fd3ca51da88f7b06f025e780a29":{"kind":"REWORK","_number":6,"created":"2026-08-26 12:22:50.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/6"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:22:43.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/a2205881332f7fd3ca51da88f7b06f025e780a29"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/a2205881332f7fd3ca51da88f7b06f025e780a29"}]},"branch":"refs/heads/master"},"3e256edfe2808ca7d5d0c5bf066f46f3bf394105":{"kind":"REWORK","_number":7,"created":"2026-08-26 12:30:48.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/7"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:30:40.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/3e256edfe2808ca7d5d0c5bf066f46f3bf394105"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/3e256edfe2808ca7d5d0c5bf066f46f3bf394105"}]},"branch":"refs/heads/master"},"51b2a39127eb54d66937d92837b34a3cff6e1a87":{"kind":"REWORK","_number":8,"created":"2026-08-26 12:32:48.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/10/1002410/8","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/8","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/8"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 12:32:45.000000000","tz":120},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/51b2a39127eb54d66937d92837b34a3cff6e1a87"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/51b2a39127eb54d66937d92837b34a3cff6e1a87"}]},"branch":"refs/heads/master"},"9e0b0c184a36fdd8587a4a7367188b30325199ce":{"kind":"REWORK","_number":9,"created":"2026-08-27 17:22:51.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/10/1002410/9","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/10/1002410/9","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/10/1002410/9"}}},"commit":{"parents":[{"commit":"e08e4734ad7013adf6cffc3d7e45bb94ab0d4525","subject":"Merge \"Migrate OSSN txt files to build pipeline\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e08e4734ad7013adf6cffc3d7e45bb94ab0d4525"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:23:48.000000000","tz":120},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2026-08-27 17:22:38.000000000","tz":-420},"subject":"OSSN-0110: Self-service password change does not revoke generators","message":"OSSN-0110: Self-service password change does not revoke generators\n\nAdds an OpenStack Security Note covering bug 2153447: password change\nand DELETE /v3/users/{id}/tokens only revoke short-lived tokens, not\nlong-lived trusts, application credentials, EC2 credentials, or\nOAuth1 access tokens. The VMT classified this as a design gap and\ndeclined to issue an advisory, recommending it be addressed via an\nOSSN. Documents today\u0027s admin-driven disable/cleanup/re-enable\nworkaround, its federated-user caveat (bug 2129010), and the pending\natomic fix under review at\nhttps://review.opendev.org/c/openstack/keystone/+/1002408.\n\nRelated-bug: 2153447\nRelated-bug: 2129010\nRelated-bug: 2152573\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Opus 5\nChange-Id: I06c3d9061a8779549fd301d913c4a6ccf8869bfd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e0b0c184a36fdd8587a4a7367188b30325199ce"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e0b0c184a36fdd8587a4a7367188b30325199ce"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}