)]}'
{"id":"openstack%2Fzaqar~1007161","triplet_id":"openstack%2Fzaqar~stable%2F2025.2~Ib7aadf8d6de396ac9f0a11d6fcfa44849b194bf4","project":"openstack/zaqar","branch":"stable/2025.2","topic":"bug/2164987","hashtags":["CVE-2026-97404","ossa-2026-042"],"change_id":"Ib7aadf8d6de396ac9f0a11d6fcfa44849b194bf4","subject":"Fix authentication bypass by empty URL-Signature","status":"MERGED","created":"2026-09-24 14:13:39.000000000","updated":"2026-09-25 01:02:14.000000000","submitted":"2026-09-25 01:00:44.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1007161-bug/2164987","meta_rev_id":"d6e2d9f7f6ba2e3c0bfb00d363343c0db3f1e3d5","_number":1007161,"virtual_id_number":1007161,"owner":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-09-25 01:00:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"all":[{"value":2,"date":"2026-09-25 00:22:39.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"all":[{"value":1,"date":"2026-09-25 00:22:39.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-24 15:27:04.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"2559eee04222d6fd5bf3a106a139b18137faf43e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"date":"2026-09-24 14:13:39.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"6dd390d80a5a9e8eb29dc1a66d7879b23e4c9f71","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-24 15:27:04.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d10fd031da4b463babb9312edfcad32a\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e589d88c82074abd99deb1df58f968fd : SUCCESS in 4m 07s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f7acfaaffffe4c6a8e7eea8ebd016b51 : SUCCESS in 12m 21s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/8e0929695ffe4f08a225e743e4dc1573 : SUCCESS in 10m 17s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/2657f8b4626042a5a019c1e9e69fe141 : SUCCESS in 11m 05s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3ba925559de04ab788b60b6edb7eabd9 : SUCCESS in 2m 51s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/12bd54fee55348f8aa7ccd4af35fb938 : SUCCESS in 4m 24s\n- zaqar-tox-integration https://zuul.opendev.org/t/openstack/build/7c0a85b9523149539d8c8b7616ff6144 : SUCCESS in 11m 03s\n- zaqar-tempest-plugin-mongodb https://zuul.opendev.org/t/openstack/build/5c526274a5dd4a509f220a6458d75d4a : SUCCESS in 22m 05s\n- zaqar-tempest-plugin-redis https://zuul.opendev.org/t/openstack/build/31c23092927e41f991b40ca25da49405 : SUCCESS in 30m 06s\n- zaqar-tempest-plugin-swift https://zuul.opendev.org/t/openstack/build/df7bef9f0f654055adf506ea3b1e8dea : SUCCESS in 44m 32s\n- zaqar-tempest-plugin-swift-ipv6 https://zuul.opendev.org/t/openstack/build/8ef5a259c8c84c84b1527cc6ec628074 : SUCCESS in 22m 31s\n- zaqar-grenade-mongodb https://zuul.opendev.org/t/openstack/build/d31b937252bc4edfa2fa013dd0f6da96 : FAILURE in 11m 51s (non-voting)\n- zaqar-grenade-redis https://zuul.opendev.org/t/openstack/build/730ac45f8a8a44eeabd727ab0c1b89da : SUCCESS in 1h 06m 59s (non-voting)\n- zaqar-grenade-swift https://zuul.opendev.org/t/openstack/build/d38c40a188d242eab56cadc48938294e : SUCCESS in 1h 05m 17s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b4fad51890de85e1ddb060487d60cc91b4d5a09f","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-24 15:33:29.000000000","message":"Hashtag added: ossa-2026-042","accounts_in_message":[],"_revision_number":1},{"id":"6fd6c9189105e78f0f945e44a43a6c06ae0e1037","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-09-24 15:34:30.000000000","message":"Hashtag added: CVE-2026-97404","accounts_in_message":[],"_revision_number":1},{"id":"58f23bea6b1c18225fabce747b56d8497988e47e","author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"date":"2026-09-25 00:22:39.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"3d64b66e4540d71bd66b717a1bcb91f82deec76d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-25 00:23:09.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"b9966f7c53d7ec8d0ccd5604969e31784d7ea903","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-25 01:00:44.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8a5ca28c5e6045eea3837baf6a19a99c\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1f045c13a8db439a8bb982b63e86c759 : SUCCESS in 2m 45s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/ddb02be544a6470b8018cb78639a7286 : SUCCESS in 12m 13s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/119b80e660fc431697a1b7d30ae19198 : SUCCESS in 12m 18s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0ef435f81c88440581336df72f2f61cf : SUCCESS in 3m 55s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1137dfb7f1e443bc8b73febe579d4f9b : SUCCESS in 4m 50s\n- zaqar-tox-integration https://zuul.opendev.org/t/openstack/build/fc12311100c046e3b361ced4776eb76a : SUCCESS in 7m 53s\n- zaqar-tempest-plugin-mongodb https://zuul.opendev.org/t/openstack/build/dda4699821194751b203209ad56e5888 : SUCCESS in 32m 18s\n- zaqar-tempest-plugin-redis https://zuul.opendev.org/t/openstack/build/47c619e605b8447fb354014ff0ab66ee : SUCCESS in 17m 08s\n- zaqar-tempest-plugin-swift https://zuul.opendev.org/t/openstack/build/024bbb4b9d5240a196332d35ced19996 : SUCCESS in 24m 49s\n- zaqar-tempest-plugin-swift-ipv6 https://zuul.opendev.org/t/openstack/build/dea44c4f5b5a434d994fea2cf9386539 : SUCCESS in 24m 41s","accounts_in_message":[],"_revision_number":1},{"id":"68e1ff004c0a3da730e4e0f8f893a05479cba1b3","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-25 01:00:44.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"d6e2d9f7f6ba2e3c0bfb00d363343c0db3f1e3d5","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-25 01:02:14.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/86430dd7ea15483cb79900a49f567a7a\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f502d960cd8d478c867399a93aefceef : SUCCESS in 1m 07s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4af6ec86187c4cc5b61152f1d94f1bb7 : SUCCESS in 58s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"7a18ffc9d468a5fd8a58fc69468a0003d47ef4cf","revisions":{"7a18ffc9d468a5fd8a58fc69468a0003d47ef4cf":{"kind":"REWORK","_number":1,"created":"2026-09-24 14:13:39.000000000","uploader":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"ref":"refs/changes/61/1007161/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/zaqar","ref":"refs/changes/61/1007161/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/zaqar refs/changes/61/1007161/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/zaqar refs/changes/61/1007161/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/zaqar refs/changes/61/1007161/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/zaqar refs/changes/61/1007161/1"}}},"commit":{"parents":[{"commit":"46ff729c00787108be7ea3ab45a81a8d9396d74e","subject":"Do not bypass authentication for requests with EXTRA-SPEC header","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/zaqar/commit/46ff729c00787108be7ea3ab45a81a8d9396d74e"}]}],"author":{"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","date":"2026-09-24 13:46:06.000000000","tz":540},"committer":{"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","date":"2026-09-24 14:13:30.000000000","tz":540},"subject":"Fix authentication bypass by empty URL-Signature","message":"Fix authentication bypass by empty URL-Signature\n\nCloses-Bug: #2164987\nChange-Id: Ib7aadf8d6de396ac9f0a11d6fcfa44849b194bf4\nSigned-off-by: Takashi Kajinami \u003ckajinamit@oss.nttdata.com\u003e\n(cherry picked from commit fe1efeaf8abf40fe132207cce0cc14c470e98dee)\n(cherry picked from commit e7d8236443b7295c996a37f91bc87270a0f1a994)\n(cherry picked from commit 9b3313a78cc81f90c065c44cf7d1b9fe060d48d9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/zaqar/commit/7a18ffc9d468a5fd8a58fc69468a0003d47ef4cf"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/zaqar/commit/7a18ffc9d468a5fd8a58fc69468a0003d47ef4cf"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"}},{"label":"Review-Priority","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}