-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 17 Aug 2026 11:01:41 +0200 Source: swift Architecture: source Version: 2.35.1-0+deb13u3 Distribution: trixie-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1140678 1142972 1142973 Changes: swift (2.35.1-0+deb13u3) trixie-security; urgency=medium . * CVE-2026-71191 / OSSA-2026-030: Swift S3API header authorization bypass. Applied upstream patch: - "s3api: require signing of sensitive SigV4 x-amz headers" - "s3api: drop native Swift control headers from client requests" (Closes: #1142972). * CVE-2026-71192 / OSSA-2026-031: proxy denial of service via Accept header. Applied upstream patch: - "swob: avoid excessive backtracking in Accept parser" (Closes: #1142973). * CVE-2026-50221: Swift proxy-server SSRF via internal update header injection: applied upstream patch: Block internal update headers at the gatekeeper (Closes: #1140678). Checksums-Sha1: 1e47d7458955ec21348b403ee58c641d130fef46 3165 swift_2.35.1-0+deb13u3.dsc 5dc7039ecfd608a05ec987bfe49cc2fb6f587148 2706568 swift_2.35.1.orig.tar.xz ae854c83db3f911d226f3887298bab6765f74d58 38196 swift_2.35.1-0+deb13u3.debian.tar.xz 223f79ebb4a2c3b64035c335a7dd7e8a155dfa3d 14846 swift_2.35.1-0+deb13u3_amd64.buildinfo Checksums-Sha256: 6730cd82004b325f2452fd3297d93e31676cb9f6fd0911e8df288590d4bc64cb 3165 swift_2.35.1-0+deb13u3.dsc ee2bba0d77ce5bccc04db93d531ddd65ee092a1ce1070b0995f1ca8f7a3a5beb 2706568 swift_2.35.1.orig.tar.xz 89a1262a296f09c1816ef76b9348e08989b5e6b823abe760dbdf54a6a1e84096 38196 swift_2.35.1-0+deb13u3.debian.tar.xz 6e3d18523197fcd2c7b15e4c82efc20d4cec390485e114b811586affedcd2944 14846 swift_2.35.1-0+deb13u3_amd64.buildinfo Files: 65ee8fbc7f3cb844f495dd8a5688fcf1 3165 net optional swift_2.35.1-0+deb13u3.dsc 0fe9e0f72d050292fb9182633c9462af 2706568 net optional swift_2.35.1.orig.tar.xz f5600cd5a7861182df88df01583dee0e 38196 net optional swift_2.35.1-0+deb13u3.debian.tar.xz 3293c3cbcfa68c3fe971b41684523cb7 14846 net optional swift_2.35.1-0+deb13u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqEFn0ACgkQ1BatFaxr Q/6TuxAAgSko0IqFQmIwH6feQEEhUdZlfhz3u4vllnabHtb1ZhuF5QGRHR+cVmi4 DHYQJPJii72AKRRQetmRjrXW4offcb78wl4chyz0cOGoF95joLrcJkqtB1MXlun9 +o2W/GI6MByIl9mWdXnVWmrz/VRI00ToMmg6WkOwDnxi1LFvKBBC4QmGg+ONvnpI vidMwwD2SuH/unVjpmlFkoFUCkjBVo6UFB+f4zII9mKUrf0aWgSJsWh6XjPV/0dI /51KywAsVtPBF9hCNwvYmhlcnqNeS28zusMXjiNXa6YPzQKhSvYC4/IwWC7kaCnf ukyVJj3wLNOY5xsQgV14URymS4lixA7Sgn2EhdHZP/nvkfL+/eNO7r2+EEcNTcVp NG+etV7acgYulYq/udbZ8y9SkeCzR+5QdJDRfVF50i6Ocbv+Ef9YB46zIzSXF/vV dMrqYsNhd4cqspoDFiFXzDDZarJmIIEpg1pV+jAOMlOSQmifwB0GP8qp2E+eMe2b M/54qgO8QU13LsbT4fXlRgIJJZmC59Bs2xrdicAJM24I+ZziSNnKOaTcnnC6TYgk 21O5x4qMyCMOYurfNsCqed3PGe9kEI+QmSPqlTq5IjdCGXfw8Axr0VOv5Vaz3xy6 B1US0F+qaH0D8L9Mxlib6nTakcDFrxlSFHe0mBjvAKf92Qp/2TA= =0nDe -----END PGP SIGNATURE-----
