Hi,

[ Reason ]
I would like to address the security issue OSSN-0112 / GHSA-cjq3-6hm7-q33w.
The Github announce is here:
https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w

At time of writting, the OpenStack security announce is still not merged,
but can be see here:
https://review.opendev.org/c/openstack/security-doc/+/1002392/15/security-notes/OSSN-0112.yaml

[ Impact ]
The vulnerability allows authenticated users to create metrics associated
with resources belonging to other projects by bypassing authorization
checks.

As a consequence, it is possible for the attacker to make OpenStack
write what it wants, and possibly (if the victime uses auto-scalling)
make the victim auto-scaller Heat script be fooled into thinking it
need to scale up, and spend too much money on a public cloud deployment.

[ Tests ]
The patch includes new unit tests. We also have put the fix into
production in our public cloud deployment.

[ Risks ]
Not much, the patch is small, and easy to understand. It just checks
if a resource is there within the scope of the user, meaning that it
will not appear as existing if the resource is owned by someone else.
Basically, the patch adds this:

try:
    resource = pecan.request.indexer.get_resource(
        "generic", resource_id)
except indexer.NoSuchResource:
    abort(404, str(indexer.NoSuchResource(resource_id)))

(plus some tests)

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Just as per above.

Please accept gnocchi/4.6.5-1+deb13u1
Note I already uploaded it, as I've been told this is possible, and
if no controvercy.

Cheers,

Thomas Goirand (zigo)