-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 03 Aug 2026 09:47:00 +0200 Source: neutron Architecture: source Version: 2:26.0.3-0+deb13u3 Distribution: trixie-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1142937 1143170 Changes: neutron (2:26.0.3-0+deb13u3) trixie-security; urgency=medium . * CVE-2026-55707: subnetpool onboarding cross-project subnet mutation. Applied upstream fix: CVE-2026-55707-stable-2025.1.patch. (Closes: #1143170). * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" Checksums-Sha1: 2d67b747dd22de74daafbaa0110ef72823b30a26 5086 neutron_26.0.3-0+deb13u3.dsc 153a29dc30b55187ea6bb052e94cb48d012dc500 10241136 neutron_26.0.3.orig.tar.xz db5a3ddd1005b90ceea8409f67b12d77a1ff95a1 51024 neutron_26.0.3-0+deb13u3.debian.tar.xz c5a1a5701c24e48fe685cdba207ed3aa3cc8c052 23276 neutron_26.0.3-0+deb13u3_amd64.buildinfo Checksums-Sha256: 245caa7ab2dc69a3ae51839307682c1e86766c7021dbf37a6cddf7dfdfb81bc8 5086 neutron_26.0.3-0+deb13u3.dsc 611e8b2e2aab1f6585bd426bcb91b94c3f88215d2913aa1158f6a604d448c1be 10241136 neutron_26.0.3.orig.tar.xz 214fcd5c30a791ef72170e06ce306528b165708de5c397ef94bc326d71851399 51024 neutron_26.0.3-0+deb13u3.debian.tar.xz a202d21e8df4a39566b9a21c6d86e141061c82a543d09c360b59eda6d6f8af12 23276 neutron_26.0.3-0+deb13u3_amd64.buildinfo Files: f5dcebeee8b982d0eb023a6ccef124cb 5086 net optional neutron_26.0.3-0+deb13u3.dsc 605a4f7f503a30e367b766d6a903f853 10241136 net optional neutron_26.0.3.orig.tar.xz b6ef864b86ef5319db7f7e872256c7c2 51024 net optional neutron_26.0.3-0+deb13u3.debian.tar.xz e2a7b774dbb7492e9210a193275efe71 23276 net optional neutron_26.0.3-0+deb13u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp65/IACgkQ1BatFaxr Q/6s/BAAnvbo95qhu2o8210rJAd3EGecAfduUyPIjrAllqTb4HLKEo2OCw0FBzVL i8DkqlRdxCPb3VtldS+IK5iPCaDWv1o/UhOCVU6eh5LUbt5id/37N060mZzuaxUF QGkcN9kdw0lb+jXa+W7u/AY2XJTSxhzc0TBYDbj/KJrYk7j53XplHcg6N+I9Nxdk 1mz4BxvX3glUJYsSHmQOVzg5mXydS6z8O0cv6PUOWCpCBn21VGIOXRpjnXvdVmE2 dOz1a6IX0fvbQGuTwMQHAhlVbppr6RsiUaoial6vsyyJuUA0Sz7gOUiK4rUYXsS1 CxRWCf5aiUmsPttosa6aeV9rMWJjgyu0dRux7G1kadwWpzSEENnm3uVA6OWFOBVT xQl4+IpcsAIAeMBOFgeDK60OeZYWprjRn4a2RUf9wzKjJt8v028pL9c2GNgHXjnT XsDZr2oqUj9QSerdNVaUkB5sogcpU/RTAipHcTDHWiUnS70Y8l0zG7EfpXLqpMYR rYXn1CCSDKy6REnZ6+b6ruTKfUhMflf9Vpgd8yLhKeY8T0pTFnl/hekJ5Ycp+lYf BHjZaRHP6+MRo+WDIZHVfwn/+YQc2XUou0scg7FMFq6nxT3uAKXusuWgrkvf/Ios cSUFLLlaWBHls32AE73UBkJf9JfmTkQknetHy3r+SdF1EEDwwj0= =mLX3 -----END PGP SIGNATURE-----
