There was another security issue with bugzilla that has been fixed,
unfortunately it was a CSRF issue, which has meant that git bz needs
to be updated to deal with tokens better.
Until git-bz is fixed, the attach will no longer work
It should now be possible to use git-bz normally to attach patches and change bug statuses. As it turns out, there was a Bugzilla patch [1] made after the security release that fixes a problem with token-handling that the security patch introduced.
Many thanks to Chris Cormack for wrangling Bazaar.