There are 3 open security issues in bookworm.
commit d5590eb580235d8201170ecd18836a827fc98b31
Author: Thomas Goirand <zigo@debian.org>
Date: Fri Oct 16 09:20:13 2026 +0200
Honor sys.argv in the WSGI entry point
Pass sys.argv[1:] to the WSGI entry point config parser: uwsgi daemons
cannot take --log-file on their own command line, and openstack-pkg-
tools (>= 153) passes --log-file to the WSGI application through
uwsgi --pyargv. zaqar ignored sys.argv (hardcoded empty argv), so
oslo.log, with only log_dir set, derived the log filename from the
bottom-most Python stack frame, which under uwsgi is the frozen
importlib machinery: the API logged into /var/log/zaqar/<frozen
importlib._bootstrap>.log.
commit ca03aa4e927325f561745dcc3cd14ca39ddb6eb2
Author: Thomas Goirand <zigo@debian.org>
Date: Thu Oct 8 11:05:35 2026 +0200
Renamed CVE-2026-pending as CVE-2026-107363.
Among the 5 debian patches available in version 23.0.0-3 of the package, we noticed the following issues:
![[bug history graph]](https://qa.debian.org/data/bts/graphs/z/zaqar.png){kind=link}