Dear Stable release team,

[ Reason ]
I'd like to upload a new version of Zaqar to address:
https://security.openstack.org/ossa/OSSA-2026-029.html
aka:
https://bugs.debian.org/1142858

[ Impact ]
As per upstream announce:

OpenStack Zaqar through 22.0.0 allows authentication bypass via an
EXTRA-SPEC header when a UUID is known.

[ Tests ]
Tests are run at package build time. Otherwise, I do rely
on upstream CI for functional tests (as I do not run Zaqar
in production myself).

[ Risks ]
The patch is rather small.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Just upstream patch.

Please allow me to upload Zaqar 20.0.0-2+deb13u1 to p-u.

Cheers,

Thomas Goirand (zigo)

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

Hi Adam,

I integrated this change to the previous ones (re-indented here, so it
wraps at 74 cols, for readability):

   * CVE-2026-97404 / OSSA-2026-042: Zaqar empty URL-Signature header
     bypasses authentication. Applied upstream patch "Fix authentication
     bypass by empty URL-Signature". (Closes: #1148897):
     - CVE-2026-97404_OSSA-2026-042_Fix_authe....patch
   * CVE-2026-107363 / OSSA-2026-043: Zaqar WebSocket project
     substitution allows cross-project queue access. Applied upstream
     patch "Prohibit arbitrary project-id for websocket protocol access".
     (Closes: #1150261):
     - CVE-2026-107363_OSSA-2026-043_Prohibit_arbitrary_....patch

New debdiff is attached. Package has been uploaded. Please approve it.

Cheers,

Thomas Goirand (zigo)