Accepted designate 1:22.0.0-2 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 06 Aug 2026 10:01:30 +0200
Source: designate
Architecture: source
Version: 1:22.0.0-2
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1144145
Changes:
 designate (1:22.0.0-2) unstable; urgency=high
 .
   * CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034:
     - An authenticated tenant can bypass zone ownership checks by scheduling a
       zone to a different pool, creating overlapping zones that hijack or deny
       service to another tenant's DNS records. Any user with the default
       create_zone policy can exploit this when the AttributeFilter scheduler is
       enabled. Only deployments using the AttributeFilter scheduler with
       multiple pools are affected.
     - The mDNS handler performs pool-blind record lookups that fail when
       colliding zones exist across pools, causing deterministic DNS query
       failures. The NOTIFY handler path is reachable via unauthenticated UDP.
     Applied upstream patches:
     - Require TSIG keys for zones in non-default pools
     - Fix mDNS record query pool scoping for split-horizon DNS
     - Fix cross-tenant/cross-pool zone ownership bypass
     (Closes: #1144145).
Checksums-Sha1:
 e545126cb7507e51fc08bc5c0aa1094f530a961a 4248 designate_22.0.0-2.dsc
 088c255ce1aa0a2cb51d9647fd9abc3ad1b2b9d4 26624 designate_22.0.0-2.debian.tar.xz
 7aed592dbefc0dc375eec413c61cccc07ab03993 21816 designate_22.0.0-2_amd64.buildinfo
Checksums-Sha256:
 d9b73375bcc0988989892080e205b6c4f946e45f5eae0936c7699f851d381b36 4248 designate_22.0.0-2.dsc
 f0e4c516f33e4c0ab6236758b754dc8b8960b6533ab4fb947a986786c06e755f 26624 designate_22.0.0-2.debian.tar.xz
 424681d836e608b01057094ff907b1fecb89e45172c2eb40fea6f6c9c5780cee 21816 designate_22.0.0-2_amd64.buildinfo
Files:
 13b36456a71ec3b65d649da5899a7002 4248 net optional designate_22.0.0-2.dsc
 2035755bd533c143bd58a6bb265b0e52 26624 net optional designate_22.0.0-2.debian.tar.xz
 b68bfa642150c84d0fb8220e34d1b9ea 21816 net optional designate_22.0.0-2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8bFMACgkQ1BatFaxr
Q/79Xg/+MMY9EodXPilff+gqzMuWFMejwGoMkn4eVzPXU1g/ZOlD5GYzwf97rQyn
j9RTz5kwy4k56X6Nenm5CKibEhH3DhrPqxhlFwZguFMjOKk1RCQvjxT5hn/LeJdX
zi28guHbgaYRu4WQNP3smtsFk0dIp7SBbqr7i2+V6GrRxLGVG3P6IfE8JdWHxwmc
n6/kK/aFO2jkgldvb4GMpJWFSFTD3bVmvdm5kab5OzkihiyAk9fpkHJHOdcmDzV3
vvVHKZ0ejMBpUii0mXp4tjgJs7ogcwbfkClh23dF2a5dG4lqFDTVcFUJF6klRDAd
GOehORDhgqvgton4vnIc0sM6D7nvwBatquOThWl5OE6gPlHm+bdp+5Hk6aS91rsi
XRBcIv/vgltcAgIRUJBYWWXox/XnJTtGkSZuafHLaCJOxK/iBf5d6zKAyuBE49ZH
5UWszi1jDC6mMdlTnvvBf5Tp8BOVbOUUQxbYUMo+CV0trwhsth/TeKVEJFz53OUp
oqHhC/pgq7eYYidnRkXTUKy6msGQ1D0x37ltbN5iWYF1hEPpIg48dpT+LzWrytSv
z/AiUD/Hzci0TMmtECq9eeBZqWDxbwbWMSEhqlFse0scu3elKgKTthBEFjs1jIas
k4CDFx89TF3sWxBciJEgUBX7uiOPH3zQSuSCfxh+3g/EUI9sPyw=
=/4tG
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanxvTwAKCRCb9qggYcy5
IdagAP9Avmz+1TykX6vdQMqZb2mmB2llX8vIyU7NHWioEtMwSQEAjoU2wT7gNIyd
6uC5LIVYiqgnSNtI4jgyuYik0hP42wk=
=67gz
-----END PGP SIGNATURE-----