Version in base suite: 4.6.5-1

Base version: gnocchi_4.6.5-1
Target version: gnocchi_4.6.5-1+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gnocchi/gnocchi_4.6.5-1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gnocchi/gnocchi_4.6.5-1+deb13u1.dsc

 changelog                                                              |   10 +
 patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch |   69 ++++++++++
 patches/series                                                         |    1 
 3 files changed, 80 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj8mfd_zn/gnocchi_4.6.5-1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj8mfd_zn/gnocchi_4.6.5-1+deb13u1.dsc: no acceptable signature found
diff -Nru gnocchi-4.6.5/debian/changelog gnocchi-4.6.5/debian/changelog
--- gnocchi-4.6.5/debian/changelog	2025-03-28 13:54:00.000000000 +0000
+++ gnocchi-4.6.5/debian/changelog	2026-09-23 10:38:32.000000000 +0000
@@ -1,3 +1,13 @@
+gnocchi (4.6.5-1+deb13u1) trixie; urgency=medium
+
+  * OSSN-0112 / GHSA-cjq3-6hm7-q33w: Improper Access Control through
+    /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce
+    update resource policy metric creation" (Closes: #1150009):
+    - OSSN-0112_Enforce-update-resource-policy-metric-creation.patch
+    - CVE-2018-11774_OSSN-0112_Enforce-update-resource-policy-metric-c....patch
+
+ -- Thomas Goirand <zigo@debian.org>  Wed, 23 Sep 2026 12:38:32 +0200
+
 gnocchi (4.6.5-1) unstable; urgency=medium
 
   * New upstream release.
diff -Nru gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch
--- gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch	1970-01-01 00:00:00.000000000 +0000
+++ gnocchi-4.6.5/debian/patches/OSSN-0112_Enforce-update-resource-policy-metric-creation.patch	2026-09-23 10:38:32.000000000 +0000
@@ -0,0 +1,69 @@
+Description: Enforce update resource policy metric creation
+ When passing the resource_id in the request body
+ we should load the resource by ID and enforce the
+ `update resource` policy with the loaded resource.
+Bug-Debian: https://bugs.debian.org/1150009
+Author: Tobias Urdin <tobias.urdin@binero.com>
+Date: Tue, 22 Sep 2026 17:05:44 +0200
+Change-Id: I519433b8e3d8e52daf22be67d9b3d9bfd2c6fa06
+Signed-off-by: Tobias Urdin <tobias.urdin@binero.com>
+Origin: upstream, https://github.com/gnocchixyz/gnocchi/commit/db32814f594bae25a8483c6d9af4e6378191b7c3
+Last-Update: 2026-10-05
+
+diff --git a/gnocchi/rest/api.py b/gnocchi/rest/api.py
+index 6e23a4c8..71c4116a 100644
+--- a/gnocchi/rest/api.py
++++ b/gnocchi/rest/api.py
+@@ -595,6 +595,12 @@ class MetricsController(rest.RestController):
+                        "reason": "Name cannot be null "
+                        "if resource_id is not null"})
+             original_resource_id, resource_id = resource_id
++            try:
++                resource = pecan.request.indexer.get_resource(
++                    "generic", resource_id)
++            except indexer.NoSuchResource:
++                abort(404, str(indexer.NoSuchResource(resource_id)))
++            enforce("update resource", resource)
+ 
+         enforce("create metric", {
+             "creator": creator,
+diff --git a/gnocchi/tests/test_rest.py b/gnocchi/tests/test_rest.py
+index 0171bde5..353e8d0d 100644
+--- a/gnocchi/tests/test_rest.py
++++ b/gnocchi/tests/test_rest.py
+@@ -659,6 +659,35 @@ class MetricTest(RestTest):
+              metric2: []},
+             result)
+ 
++    def test_metric_with_resource_id_from_other_user(self):
++        resource_id = str(uuid.uuid4())
++        self.app.post_json(
++            "/v1/resource/generic",
++            params={
++                "id": resource_id,
++                "user_id": TestingApp.USER_ID,
++                "project_id": TestingApp.PROJECT_ID,
++            },
++        )
++
++        with self.app.use_another_user():
++            self.app.get(
++                "/v1/resource/generic/%s" % resource_id,
++                status=403,
++            )
++
++        with self.app.use_another_user():
++            self.app.post_json(
++                "/v1/metric",
++                params={
++                    "archive_policy_name": "low",
++                    "resource_id": resource_id,
++                    "name": "cpu",
++                    "unit": "ns",
++                },
++                status=403,
++            )
++
+ 
+ class ResourceTest(RestTest):
+     def setUp(self):
diff -Nru gnocchi-4.6.5/debian/patches/series gnocchi-4.6.5/debian/patches/series
--- gnocchi-4.6.5/debian/patches/series	2025-03-28 13:54:00.000000000 +0000
+++ gnocchi-4.6.5/debian/patches/series	2026-09-23 10:38:32.000000000 +0000
@@ -2,3 +2,4 @@
 install-missing-files.patch
 add-disable_by_file_path.patch
 change-default-number-of-sacks.patch
+OSSN-0112_Enforce-update-resource-policy-metric-creation.patch