blazar (18.0.0~rc1-3) unstable; urgency=medium

  * CVE-2026-93852: In OpenStack Blazar before 17.0.1, the V2 lease listing
    operation (GET /v2/leases) returns leases for every project without
    enforcing project scoping or an administrator-only policy. Any
    authenticated user with access to the Blazar REST API can enumerate leases
    belonging to other tenants, exposing lease IDs, reservation IDs, resource
    IDs, and reservation metadata. The exposed lease IDs also enable the
    object-level authorization bypass tracked in the companion request,
    allowing an attacker to then modify or delete the enumerated leases.
    .
    CVE-2026-93854: In OpenStack Blazar before 17.0.1, the V2 lease API does
    not enforce object-level authorization on its update and delete operations
    (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy
    authorize() wrapper attempts to load the target lease to build the
    authorization target from its owner, but it looks up the lease under the
    keyword "lease_id" whereas the controller methods name the parameter "id"
    (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup
    returns None, and thus authorization falls back to the requesting user's
    own project_id/user_id instead of the target lease owner. Any authenticated
    user who knows a lease ID can therefore modify or delete leases belonging
    to other users and projects, bypassing the intended ownership check.
    .
    Applied upstream patch (Closes: #1148408).
    - CVE-2026-93852_CVE-2026-93854_Fix_v2_API_object-level_authorizat....patch

 -- Thomas Goirand <zigo@debian.org>  Mon, 21 Sep 2026 17:37:21 +0200

blazar (18.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sun, 20 Sep 2026 12:46:45 +0200

blazar (18.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.
  * Do not install blazar-api-wsgi, gone from upstream.

 -- Thomas Goirand <zigo@debian.org>  Wed, 09 Sep 2026 20:54:40 +0200

blazar (17.0.0-2) unstable; urgency=medium

  * Fix "su" parameters order.

 -- Thomas Goirand <zigo@debian.org>  Mon, 13 Apr 2026 12:34:52 +0200

blazar (17.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Apr 2026 13:41:19 +0200

blazar (17.0.0~rc1-3) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 27 Mar 2026 08:56:30 +0100

blazar (17.0.0~rc1-2) experimental; urgency=medium

  * Add OS_OSLO_MESSAGING_RABBIT__PROCESSNAME=blazar-api.

 -- Thomas Goirand <zigo@debian.org>  Wed, 18 Mar 2026 09:55:38 +0100

blazar (17.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Rebased install-all-files.patch.
  * Removed --format when building the policy yaml file.

 -- Thomas Goirand <zigo@debian.org>  Wed, 11 Mar 2026 14:27:25 +0100

blazar (16.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Oct 2025 21:37:16 +0200

blazar (16.0.0~rc1-3) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sun, 28 Sep 2025 23:33:46 +0200

blazar (16.0.0~rc1-2) experimental; urgency=medium

  * Fixed UWSGI_INI_APP= in api init script.

 -- Thomas Goirand <zigo@debian.org>  Thu, 18 Sep 2025 21:56:34 +0200

blazar (16.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Switch blazar-api-uwsgi.ini to module=blazar.wsgi.api:application instead
    of now removed wsgi-script.
  * Removed fix-lease-date-not-enough-in-the-future.patch applied upstream.

 -- Thomas Goirand <zigo@debian.org>  Fri, 12 Sep 2025 10:09:30 +0200

blazar (15.0.0-3) unstable; urgency=medium

  * export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons.

 -- Thomas Goirand <zigo@debian.org>  Fri, 11 Jul 2025 12:21:03 +0200

blazar (15.0.0-2) unstable; urgency=medium

  * Add fix-lease-date-not-enough-in-the-future.patch (Closes: #1104885).

 -- Thomas Goirand <zigo@debian.org>  Mon, 12 May 2025 12:36:04 +0200

blazar (15.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 02 Apr 2025 13:04:38 +0200

blazar (15.0.0~rc1-3) unstable; urgency=medium

  * Re-upload source-only.

 -- Thomas Goirand <zigo@debian.org>  Tue, 01 Apr 2025 09:25:44 +0200

blazar (15.0.0~rc1-2) experimental; urgency=medium

  * Fixed d/copyright copyright holder list.

 -- Thomas Goirand <zigo@debian.org>  Fri, 14 Mar 2025 16:05:04 +0100

blazar (15.0.0~rc1-1) experimental; urgency=medium

  * Initial packaging (Closes: #1100490).

 -- Thomas Goirand <zigo@debian.org>  Thu, 19 Dec 2024 16:48:27 +0100
