Package "barbican-common"

  barbican (1:10.1.0-0ubuntu2.2) focal-security; urgency=medium

  * SECURITY UPDATE: access policy bypass via query string injection
    - debian/patches/CVE-2022-3100.patch: don't use contents of query
      string in barbican/api/controllers/__init__.py.
    - CVE-2022-3100

 -- Marc Deslauriers <email address hidden> Wed, 05 Oct 2022 09:31:21 -0400

  barbican (1:10.1.0-0ubuntu2.1) focal-security; urgency=medium

  * SECURITY UPDATE: Access restrictions bypass
    - debian/patches/CVE-2022-23451.patch: Change access policies to
      secret metadata in barbican/common/policies/secretmeta.py. Add a new
      role in barbican/common/policies/base.py and make use of these changes
      in barbican/api/controllers/__init__.py,
      barbican/api/controllers/secretmeta.py and
      barbican/api/controllers/secrets.py.
    - debian/patches/CVE-2022-23451-post.patch: Change secret policies in
      barbican/common/policies/secrets.py, add tests in
      barbican/tests/api/test_resources_policy.py and
      functionaltests/api/v1/functional/test_secrets_rbac.py and update
      api guide in api-guide/source/acls.rst.
    - CVE-2022-23451
  * SECURITY UPDATE: Ownership bypass
    - debian/patches/CVE-2022-23452.patch: Update container secret policies
      in barbican/common/policies/containers.py and add a new role in
      barbican/common/policies/base.py.
    - CVE-2022-23452

 -- Rodrigo Figueiredo Zaiden <email address hidden> Wed, 20 Apr 2022 18:00:29 -0300

  barbican (1:10.1.0-0ubuntu2) focal; urgency=medium

  * d/p/fix-castellan-secret-store-encoding.patch: Fix inconsistent encoding
    of SecretDTO objects (LP: #1946787).

 -- Corey Bryant <email address hidden> Mon, 01 Nov 2021 14:09:38 -0400

  barbican (1:10.1.0-0ubuntu1) focal; urgency=medium

  * d/watch: Add trailing slash to URL.
  * d/watch: Fix version string parsing.
  * New stable point release for OpenStack Ussuri (LP: #1943712).
  * d/p/resolve-alembic-migration-issue-mysql8.patch: Removed after
    inclusion in upstream release.

 -- Chris MacNaughton <email address hidden> Fri, 17 Sep 2021 10:05:07 +0000

  barbican (1:10.0.0-0ubuntu0.20.04.3) focal; urgency=medium

  * d/p/resolve-alembic-migration-issue-mysql8.patch: Update .egg-info/SOURCES.txt
    to include new migration and remove old migration.