-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 06 Aug 2026 10:25:23 +0200 Source: designate Binary: designate designate-agent designate-api designate-central designate-common designate-doc designate-mdns designate-pool-manager designate-producer designate-sink designate-worker designate-zone-manager python3-designate Architecture: all Version: 1:20.0.0-2+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Thomas Goirand Description: designate - OpenStack DNS as a Service - metapackage designate-agent - OpenStack DNS as a Service - agent designate-api - OpenStack DNS as a Service - API server designate-central - OpenStack DNS as a Service - central daemon designate-common - OpenStack DNS as a Service - common files designate-doc - OpenStack DNS as a Service - doc designate-mdns - OpenStack DNS as a Service - mdns designate-pool-manager - OpenStack DNS as a Service - pool manager designate-producer - OpenStack DNS as a Service - producer designate-sink - OpenStack DNS as a Service - sink designate-worker - OpenStack DNS as a Service - worker designate-zone-manager - OpenStack DNS as a Service - zone manager python3-designate - OpenStack DNS as a Service - Python libs Closes: 1144145 Changes: designate (1:20.0.0-2+deb13u1) trixie-security; urgency=medium . * CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034: - An authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool, creating overlapping zones that hijack or deny service to another tenant's DNS records. Any user with the default create_zone policy can exploit this when the AttributeFilter scheduler is enabled. Only deployments using the AttributeFilter scheduler with multiple pools are affected. - The mDNS handler performs pool-blind record lookups that fail when colliding zones exist across pools, causing deterministic DNS query failures. The NOTIFY handler path is reachable via unauthenticated UDP. Applied upstream patches: - Require TSIG keys for zones in non-default pools - Fix mDNS record query pool scoping for split-horizon DNS - Fix cross-tenant/cross-pool zone ownership bypass (Closes: #1144145). Checksums-Sha1: 7a6e08f7decb9370a258c2e839dd5d7df16ddee6 9972 designate-agent_20.0.0-2+deb13u1_all.deb 8eb8f2759d683a8e2976099f707a8e210c0b5e4b 28148 designate-api_20.0.0-2+deb13u1_all.deb ec95b92f2559897d14ec6a229422752cae942791 10076 designate-central_20.0.0-2+deb13u1_all.deb da3e552eee826b172d6e4ed99302ca57ddd1d2c1 50524 designate-common_20.0.0-2+deb13u1_all.deb 16a6b6482510f5f6226483b2070d9c068332019f 1443896 designate-doc_20.0.0-2+deb13u1_all.deb d9dc7cecdff99d72fa53ece2470b4861f54319ad 10148 designate-mdns_20.0.0-2+deb13u1_all.deb 70dd736a46cd921d9d16b0d79a1a0b6738586e6d 9980 designate-pool-manager_20.0.0-2+deb13u1_all.deb 77dc6d40b6f0852eaae8f32fbdfab45bf417e451 10376 designate-producer_20.0.0-2+deb13u1_all.deb 4b527b26d3042fcccce367041cbf25fa286b4c08 10160 designate-sink_20.0.0-2+deb13u1_all.deb 10ab2a75387461c0603d2e6b8369ccc4e9aded2d 10196 designate-worker_20.0.0-2+deb13u1_all.deb 47203340e4b18614a7c1fddb3a074a33e74e0ee9 9980 designate-zone-manager_20.0.0-2+deb13u1_all.deb 36be2e29c9e941736ae8962e8190ae0dcd921b1e 22265 designate_20.0.0-2+deb13u1_all-buildd.buildinfo 231794ed92698ad235f3d3371e9c84114f580f6d 6284 designate_20.0.0-2+deb13u1_all.deb 9ea3cea250b932c75d2f4d8022be47f1353e0e09 291596 python3-designate_20.0.0-2+deb13u1_all.deb Checksums-Sha256: a4737d5fb9bf88736b64fbf98fce03b6620e21342a16af71865e46b96cbb618a 9972 designate-agent_20.0.0-2+deb13u1_all.deb 63a2089c1b3e584e9e9506ca040c15b1f933f8b59835b5aacc0bfaf346404d87 28148 designate-api_20.0.0-2+deb13u1_all.deb 340dfcff38020b7153c05d7351923758d831fe6be69ce923063da11284c7f9ea 10076 designate-central_20.0.0-2+deb13u1_all.deb c880fb5e16dea676ffffa24f06fb3a7a6d17a156e27e3f63f1e35850fe612769 50524 designate-common_20.0.0-2+deb13u1_all.deb f4e2dd87bdcd486a522748aad6be25ac97dfe99fe2ee4d6b4e7b2463851754e4 1443896 designate-doc_20.0.0-2+deb13u1_all.deb c05cf4aa1f8b61d72b623d5fffa375e313fd584d803b09d2fc9ee2447768ed21 10148 designate-mdns_20.0.0-2+deb13u1_all.deb 59a57d9a0f506405c15bfc4629ebe3dd8c3f4bce51b3af81b93f26641a841f1b 9980 designate-pool-manager_20.0.0-2+deb13u1_all.deb f6ff16d518e233d9cd597a90c1ad2fc2ea08ad75d0fe6f493e9d0bdf3188639a 10376 designate-producer_20.0.0-2+deb13u1_all.deb 2fc7652f79b0d141c6c22dbb1c678efa0ebe89fbe0e983eac73de716232a0838 10160 designate-sink_20.0.0-2+deb13u1_all.deb 500a5b60583d5245478593ade3594a818091e0aaa597f4c75b80348d665fe547 10196 designate-worker_20.0.0-2+deb13u1_all.deb 169253c98d9a02cc6d94b263b0e8d8f49a0daea27e4c8066706f4c736837c731 9980 designate-zone-manager_20.0.0-2+deb13u1_all.deb 7ddf0109cf112a70397aba0b580d6bd7aac48e7f7e8e55d4ddc041b3b33aeb61 22265 designate_20.0.0-2+deb13u1_all-buildd.buildinfo d4f0b184c12cfed3b9e70f15fea15a38fb6af204b7964782d4f0c57ed27582ad 6284 designate_20.0.0-2+deb13u1_all.deb 9562d80b887c3340518f4eb864226cca6c78cf6a1d00e868357f9b8750bbd485 291596 python3-designate_20.0.0-2+deb13u1_all.deb Files: 9c34b7df7f8cab541d3f99890e00fed2 9972 net optional designate-agent_20.0.0-2+deb13u1_all.deb 7a58f77f03f2e1548ff69294d38c71e3 28148 net optional designate-api_20.0.0-2+deb13u1_all.deb 36f5b250e109df3d730958a618ff46a9 10076 net optional designate-central_20.0.0-2+deb13u1_all.deb 7849c9ba84db2432867f9be225255080 50524 net optional designate-common_20.0.0-2+deb13u1_all.deb c81aeae4161fad0a162553f48e87a195 1443896 doc optional designate-doc_20.0.0-2+deb13u1_all.deb ba2918104bd75ab76c438d0260e7edcc 10148 net optional designate-mdns_20.0.0-2+deb13u1_all.deb c8e11c47ae23c10482d5108f5650ef16 9980 net optional designate-pool-manager_20.0.0-2+deb13u1_all.deb a2e97a24e1608e18504e79e55ae43879 10376 net optional designate-producer_20.0.0-2+deb13u1_all.deb fceaede3a02d6cc812a6bf292d0d7fec 10160 net optional designate-sink_20.0.0-2+deb13u1_all.deb bcc84133c7a29043fc65f15fd1aa94ed 10196 net optional designate-worker_20.0.0-2+deb13u1_all.deb b240988f4c6ce68e7e042d3fb5fc972c 9980 net optional designate-zone-manager_20.0.0-2+deb13u1_all.deb 61b9be26858e1621426dc91d0a6aa12d 22265 net optional designate_20.0.0-2+deb13u1_all-buildd.buildinfo c0aef230b5183607a2ef072127573393 6284 net optional designate_20.0.0-2+deb13u1_all.deb 5f6c446640b70c666a80524890c2eae0 291596 python optional python3-designate_20.0.0-2+deb13u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmqEiLEACgkQmgPNRvTf /ze5Bg//XowE0fKqmDE9ZAngLjQ9WjV+DFdIokyxX/A8inSrAr3HtaGHwdLoRz2h TYZetGvHtog/C+l8vGmWwMtwpmtVBaxyXjDzlw8+ms/Jhb7E1eAng2pcvShzwQbF WCAqrZ86gAj2YeNKHLTQesbY+Wp3nOnXSeiw5kOSOONcJOMFMzBgdCGXB94EHVPz SeVykuSGEkqtbHsEr/Mwm8B7FgzpP8tEd+0BxKRDK5FeV/zscCVYMglfS3kT3Mfg 0pkBjHiP/ceS5X/jmY3hPcPRBOBKbg1Ek2pK0NhKke2F+9jk865orcxQ8XPcEcL8 8KT6U2JZ4Tr3ItIJJhKzCP3/ynkDm5gKxs8CVzTO2P2lU2BLYWRO7Ry0cwH1902O Fg0Phb8gF+wmFonAwVeLLM4yVJkn3CqrQSAOjJKGnHSTQinCSvDgf5Lz2mbDMdjw tNIY+x1ehoFhPmaCdc9pSkNup6ghNXhXtBVTTNqpp4MtjErYNRaSsFQ1+K3YnVFj w8kT5bDB2aybNZp4Js5u4TZRSrCfzcfOqNQvqhQCRtsA8vjGzVjFYK/Ff4ziOkmW 4Xf8zyIswh+JU1N8hsibrN6/pWb8lO6CRgPxigmgdk6uvb9HtEzLpV9VPqjw0d7e 2SSb4z+mVH/e7MQr6EK8v8GkRJ1gQa6faMnmOhC7QGeXZhkw5rs= =7Gjr -----END PGP SIGNATURE-----