)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"767fd18f3ee9512ed60c2e8707bf5c051173d8a5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"0b316b99_94feb083","updated":"2026-10-07 21:36:30.000000000","message":"@tobias.urdin@binero.com\n\nThanks for fixing this up; The only thing is the date now. If we merge this as-is, we\u0027ll announce this only tomorrow (2026-10-08). Since we\u0027ve queued up a few, if anyone is eager, we might come back here and tweak the date and send it out today.","commit_id":"d3410b6fa75ef587fb75ffb440d44af6022e015a"}],"security-notes/OSSN-0109.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"4c76e757209d066829d74782a7543fcd03fc7a5e","unresolved":true,"context_lines":[{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"},{"line_number":11,"context_line":"  metrics with resources owned by others by passing resource_id in the request"},{"line_number":12,"context_line":"  body bypassing proper authorization checks."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"a01433c5_a1f7d18d","line":10,"updated":"2026-10-07 21:56:34.000000000","message":"IMO there is value in indicating somewhere -- notes field? -- that Gnocchi is no longer an OpenStack deliverable and this OSSN is as a courtesy to our operators","commit_id":"d3410b6fa75ef587fb75ffb440d44af6022e015a"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"e36bbd6f82aca3195e58fe208df1f2ae0fabaff0","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"},{"line_number":11,"context_line":"  metrics with resources owned by others by passing resource_id in the request"},{"line_number":12,"context_line":"  body bypassing proper authorization checks."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"182791c2_9d7febfc","line":10,"in_reply_to":"a01433c5_a1f7d18d","updated":"2026-10-07 22:07:09.000000000","message":"+1, followed the discussion on IRC as well and added a line to note that gnocchi\u0027s upstream is github.com. Let me know if that\u0027s okay","commit_id":"d3410b6fa75ef587fb75ffb440d44af6022e015a"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21a6e6f223f63b8de5841649f32d8c1e027d33de","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"},{"line_number":11,"context_line":"  metrics with resources owned by others by passing resource_id in the request"},{"line_number":12,"context_line":"  body bypassing proper authorization checks."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"e0f9835f_3297a229","line":10,"in_reply_to":"a01433c5_a1f7d18d","updated":"2026-10-07 22:07:28.000000000","message":"Done","commit_id":"d3410b6fa75ef587fb75ffb440d44af6022e015a"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"21a6e6f223f63b8de5841649f32d8c1e027d33de","unresolved":true,"context_lines":[{"line_number":29,"context_line":"  The attacker can use this to squat on metric names, other members in the project"},{"line_number":30,"context_line":"  cannot delete metrics created by the attacker due to (correct) policy enforcement."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  This vulnerability was originally disclosed by gnocchi\u0027s upstream on github.com."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"recommended-actions: |"},{"line_number":35,"context_line":"  Upgrade to a version containing the fix or apply the relevant patch and restart"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"461ceeef_8570bb11","line":32,"updated":"2026-10-07 22:07:28.000000000","message":"```suggestion\n  This vulnerability was originally disclosed by gnocchi\u0027s upstream at\n  `\u003chttps://github.com/gnocchizyz/gnocchi\u003e`__ in `GHSA-cjq3-6hm7-q33w \u003chttps://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w\u003e`__.\n```\n\nI think I did link rendering right in the suggestion...","commit_id":"1af33f334f951b1305e418790b6c8930f3dbb89c"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"a3cfd6dc6b3d6e54c2ede20b43721ec9db869be0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"  The attacker can use this to squat on metric names, other members in the project"},{"line_number":30,"context_line":"  cannot delete metrics created by the attacker due to (correct) policy enforcement."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  This vulnerability was originally disclosed by gnocchi\u0027s upstream on github.com."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"recommended-actions: |"},{"line_number":35,"context_line":"  Upgrade to a version containing the fix or apply the relevant patch and restart"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9d21b894_fc35c2fd","line":32,"in_reply_to":"461ceeef_8570bb11","updated":"2026-10-07 22:12:47.000000000","message":"Done","commit_id":"1af33f334f951b1305e418790b6c8930f3dbb89c"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"3bb2ca9d039fa10f765f1910858655e416524b31","unresolved":false,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-10-07\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"72715713_6061dd3d","line":7,"updated":"2026-10-07 22:19:38.000000000","message":"I want to wait for the Sphinx render, because it\u0027s no clear whether this will render as a string or a bullet list item.","commit_id":"1e83c956ee23a86919143192368e61e905e4dab1"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"549ffcd1c190ca7307776a1e0f6e303c30824a53","unresolved":false,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-10-07\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ed041bf1_8b0d587b","line":7,"updated":"2026-10-07 22:32:26.000000000","message":"Looks like in this case it did create a bullet list, so the trailing | was simply ignored.","commit_id":"1e83c956ee23a86919143192368e61e905e4dab1"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"8d28076db85d8a1eea524fae897b0c3695616bfb","unresolved":true,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-10-07\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (\u003c4.6.6, \u003d\u003d4.7.0)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"26d7d9b8_553bd2e6","line":7,"in_reply_to":"72715713_6061dd3d","updated":"2026-10-07 22:29:39.000000000","message":"I don\u0027t know what type it used for the render, but the output LGTM.","commit_id":"1e83c956ee23a86919143192368e61e905e4dab1"}],"security-notes/OSSN-0112.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"16c2765436b83d3fd9d5e7e57d74bd348a29449d","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"49130c12_7e040e6a","line":1,"range":{"start_line":1,"start_character":4,"end_line":1,"end_character":13},"updated":"2026-10-07 21:09:56.000000000","message":"could you please renumber this to OSSN-0109? We\u0027re waiting on some more changes to edit the currently drafted 0109. So we\u0027ll end up publishing that after we publish this.","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"767fd18f3ee9512ed60c2e8707bf5c051173d8a5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2add94f3_5222ffcb","line":1,"range":{"start_line":1,"start_character":4,"end_line":1,"end_character":13},"in_reply_to":"49130c12_7e040e6a","updated":"2026-10-07 21:36:30.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"50b77455a93a3fbdd1e3abea8273adf79dabc575","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2cc4f480_3c889d3a","line":1,"range":{"start_line":1,"start_character":4,"end_line":1,"end_character":13},"in_reply_to":"49130c12_7e040e6a","updated":"2026-10-07 21:33:22.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"16c2765436b83d3fd9d5e7e57d74bd348a29449d","unresolved":true,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"2259f090_2df17ea4","line":4,"range":{"start_line":4,"start_character":5,"end_line":4,"end_character":18},"updated":"2026-10-07 21:09:56.000000000","message":"This should be the date this merges, i.e., \n\n\u00272026-10-08\u0027","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"767fd18f3ee9512ed60c2e8707bf5c051173d8a5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5b3028da_511ff11b","line":4,"range":{"start_line":4,"start_character":5,"end_line":4,"end_character":18},"in_reply_to":"2259f090_2df17ea4","updated":"2026-10-07 21:36:30.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"50b77455a93a3fbdd1e3abea8273adf79dabc575","unresolved":false,"context_lines":[{"line_number":1,"context_line":"id: OSSN-0112"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Cross-project metric association bypass in Gnocchi"},{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"783271d1_210bf527","line":4,"range":{"start_line":4,"start_character":5,"end_line":4,"end_character":18},"in_reply_to":"2259f090_2df17ea4","updated":"2026-10-07 21:33:22.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"16c2765436b83d3fd9d5e7e57d74bd348a29449d","unresolved":true,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b5a14aa6_68911ecf","line":7,"range":{"start_line":7,"start_character":13,"end_line":7,"end_character":50},"updated":"2026-10-07 21:09:56.000000000","message":"rewrite it like this:\n\n```\nGnocchi (\u003c4.6.6, \u003d\u003d4.7.0)\n```","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"50b77455a93a3fbdd1e3abea8273adf79dabc575","unresolved":false,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"6a499081_10ac136b","line":7,"range":{"start_line":7,"start_character":13,"end_line":7,"end_character":50},"in_reply_to":"b5a14aa6_68911ecf","updated":"2026-10-07 21:33:22.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"767fd18f3ee9512ed60c2e8707bf5c051173d8a5","unresolved":false,"context_lines":[{"line_number":4,"context_line":"date: \u00272026-09-28\u0027"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"affected-services: |"},{"line_number":7,"context_line":"  - Gnocchi (all versions prior to 4.6.6 and 4.7.1)"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"summary: |"},{"line_number":10,"context_line":"  The Gnocchi metric creation endpoint allows authenticated users to associate"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9810d016_26ac6b69","line":7,"range":{"start_line":7,"start_character":13,"end_line":7,"end_character":50},"in_reply_to":"b5a14aa6_68911ecf","updated":"2026-10-07 21:36:30.000000000","message":"Done","commit_id":"9437f5744868ccd7b087f9e03dc594862e5e7364"}]}