-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 24 Sep 2026 15:30:56 +0200 Source: swift Architecture: source Version: 2.35.1-0+deb13u4 Distribution: trixie-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1148834 Changes: swift (2.35.1-0+deb13u4) trixie-security; urgency=medium . * CVE-2026-97149 / OSSA-2026-041: TempURL PUT with an X-Copy-From header reads another container (cross-container information disclosure). Applied upstream patch: - CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tem....patch ("tempurl: Disallow X-Copy-From on tempurl requests") (Closes: #1148834). * Blacklist two more non-deterministic tests of the same family as the already blacklisted test_operations_timing_stats_with_incr_timeout: - test_operations_timing_stats_with_get_timeout - test_operations_timing_stats_with_set_timeout Checksums-Sha1: c5db6eb041e1c01d65489377298ceb2d0d43c1e4 3165 swift_2.35.1-0+deb13u4.dsc 5dc7039ecfd608a05ec987bfe49cc2fb6f587148 2706568 swift_2.35.1.orig.tar.xz bef424f0edf1e57067adab3009a42834e6a9adb0 39080 swift_2.35.1-0+deb13u4.debian.tar.xz f62d336aab207bba0f0abc0f1f97cbfbd4fb2875 14989 swift_2.35.1-0+deb13u4_amd64.buildinfo Checksums-Sha256: d96c963dd70dfedbb21f696c39c4c10414a03bcce0f8346089783179666081a8 3165 swift_2.35.1-0+deb13u4.dsc ee2bba0d77ce5bccc04db93d531ddd65ee092a1ce1070b0995f1ca8f7a3a5beb 2706568 swift_2.35.1.orig.tar.xz c512aec30fcd200f29213e2a9f1658c4af27abb11ab46716069881f9155a0f13 39080 swift_2.35.1-0+deb13u4.debian.tar.xz 6725c80b8a10ded01d86c8566ae58c637b688726506489762c8ea0931bbac341 14989 swift_2.35.1-0+deb13u4_amd64.buildinfo Files: 31cc64ba1adf9d2b031a58453ea60b3b 3165 net optional swift_2.35.1-0+deb13u4.dsc 0fe9e0f72d050292fb9182633c9462af 2706568 net optional swift_2.35.1.orig.tar.xz 501c7c727b91d7edb053e0b7e92eda70 39080 net optional swift_2.35.1-0+deb13u4.debian.tar.xz dd5eccaeab456c1e21699609a4b64adb 14989 net optional swift_2.35.1-0+deb13u4_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmq1lQYACgkQ1BatFaxr Q/4bpQ//c8SO1BmfFCtuhJOYMpAYtJwvYsJYi8vExSGQW3FpJ/xyVYbI0XLq+YBw zSRTac1PWIFCBKOTd6k/qXywkqLAV+74Mladnrur/OiPWCzK3XgBA9ILrhmD13vS WB26tb9gR0jfBnmm8DHf9BN12jPDuvGqwsBPYiX/yPRC0YyHbsRVJD0/2CGG8/2z QtCg1JCv3jJLE83mFOj3o2cXm1Qlg8mjV6qF+aLgmmS7iqA44mU19netbWbf066L lLMSGCrGF0e7p+cziJiiNHeKAzU0ZrwROR4uUhhtmVxOdmjFXcjYPj0kdOObmTp5 KhmT8WZY5018UW6nXk4DTHSsRLrCb6nUklKMw4CZDmNl/r7DBxjq6bQ/+/ifDCmf Ip28shU87OUicUdYCaLqZGzktSooc/JCMubBOS7pFl9DEiz7GmQnIaLJCQzsswMk /G6/xSMqgHngBeGjqLCMZHIGn2kfBLTLbt6NI8usl9j/1CXN+ieuc+90aIp32y2e zZaPPEjBGgt6dyku8l4ui+Nc5fwT0GSKyrQfuc3dAdTOEyjfO2/IAEG05b44paxG n7AxT+VTKY+oDSncSN/TN31KVedJ67MyZIxrFFrLP5PiamgEwrLIervlsYLe7jUZ gKq3rg1OZSKa/mVF2himI7/qdZwHRQw4a9btgDRB5oyhcaHctY4= =oDwu -----END PGP SIGNATURE-----
