-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 27 Sep 2026 18:13:10 +0200 Source: swift Architecture: source Version: 2.30.1-0+deb12u3 Distribution: bookworm-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1142972 1148834 Changes: swift (2.30.1-0+deb12u3) bookworm-security; urgency=medium . * CVE-2026-71191 / OSSA-2026-030: Swift S3API header authorization bypass. Applied upstream patch: - "s3api: drop native Swift control headers from client requests" (CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Sw....patch) - "s3api: require signing of sensitive SigV4 x-amz headers" (CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signin....patch) (Closes: #1142972). * CVE-2026-97149 / OSSA-2026-041: TempURL PUT with an X-Copy-From header reads another container (cross-container information disclosure). Applied upstream patch: - CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tem....patch ("tempurl: Disallow X-Copy-From on tempurl requests") (Closes: #1148834). Checksums-Sha1: 555e9f9c6e1ddeb7a08aa97fb3429e087344d301 3425 swift_2.30.1-0+deb12u3.dsc 60886a25ec973273790c94f1d6e4125159b4e4b3 38716 swift_2.30.1-0+deb12u3.debian.tar.xz d5ffd3e5efbf8f7490d0a8c5b078af4e61d7b920 15913 swift_2.30.1-0+deb12u3_amd64.buildinfo Checksums-Sha256: b1fb2b43643eb714b0d9ad35b33d7135d6eb71492bbbc6502559fdc48f3b3a19 3425 swift_2.30.1-0+deb12u3.dsc f0294ec30154c4fc0b62c0f6ceab89a307f39f0775a3db9ebdb3c055cd4af6d2 38716 swift_2.30.1-0+deb12u3.debian.tar.xz c306f90df0fd552ea285f61b8d2f8821d722938adc02e14bd46d501fff436bbe 15913 swift_2.30.1-0+deb12u3_amd64.buildinfo Files: f7468428ee7621aceedcf069bdd44b57 3425 net optional swift_2.30.1-0+deb12u3.dsc 81f30986e0ebd7599f65db6a0da2179e 38716 net optional swift_2.30.1-0+deb12u3.debian.tar.xz d4c2ca3ea99c61f7819447bd9f8a3a90 15913 net optional swift_2.30.1-0+deb12u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmq5R/0ACgkQ1BatFaxr Q/7kEw/8CruOW7W8L7LkXabz4IU8Kh3T53PxSkLylHm5zD8iGLE8IavIjz6mhoAL biF+TQcoebMY7bzIq+Ujmk0osIxsYHt00uxeQYjqv8/8fsV7FGroNZNIgndEgst6 Fjeca4DB4v54Z7cJLoy1C1007c3HF/CXm45GVKPFV6hZ6hyrHzuTKPMLj+xf+RT0 aIX0xu5PG4goeSC/y2YQq9M6CvqPTDyaqssI/i9hr40NXvGmePCsY13QUMg9Y2OT 7ZxDSD4lzdj3iS/m/a04ve1ONtZ4D1oHjiTFJuHuPctLGnd9nOzIvtjii0b6KHVf 68uJt33WIv9osOn7ca+GNRdM5Wg4KKZd3aWddbpE/cU7JXPH7/nr9+ckLaCED9qf DgEJ6VrCLbgIAMnf4MJGTs3OzQFUXlo5+8j01NbfTS1hmrgekQRrqT1cKlJM+Pwc 5kCpM1YMdSkYg6ei0b42PQnR0VjwjZe3gRZxVC2HotBw+BXanKsRqozZHT4lNw5p yO8pslS2DjyYE4Dc5yJSu7smZFsDQv9Y8mTIEiWVjaVwEH7gQOp8iLcmQqWOvXYV Iuk5UR2dVGn37AqVEKHDk8ypLNLdXrz1jotBIFnSVl3Lr4v3zHcsNkmMx+nEZiC5 YQoUHSq1WiN36PybjkoCU8Fy8jzkY3bASRms9eWNJK4pUSL+C/g= =Nksk -----END PGP SIGNATURE-----
