-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 09 Nov 2026 11:40:05 +0100 Source: octavia Architecture: source Version: 11.0.0-2+deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1144814 1148175 Changes: octavia (11.0.0-2+deb12u1) bookworm-security; urgency=medium . * CVE-2026-74248 / OSSA-2026-035: Unauthorized QoS policy deletion lock. Applied upstream patch: "Fix QoS policy validation to use request context". (Closes: #1144814). * CVE-2026-94571, CVE-2026-94572 / OSSA-2026-039: Octavia is vulnerable to an RCE in its amphora via the Octavia API. Added upstream patches (Closes: #1148175): - CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injection_via_tls_cip....patch - CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injection_via_L7_pol....patch - CVE-2026-94571_CVE-2026-94572_Fix-HAProxy-config-injection-via-L7-rul....patch * Add make-it-work-with-haproxy-2.6.patch: remove the deprecated http-use-htx option, unsupported by haproxy 2.6 as shipped in Bookworm. Checksums-Sha1: b5c9e8b103616b7e861b34572afdf387ce30a675 4338 octavia_11.0.0-2+deb12u1.dsc 613a6e73f1c5bfadd0969aba74d0d91cb1d70c24 859312 octavia_11.0.0.orig.tar.xz 88c6d0fa578548009959ff0b7ca6e9f64aac6435 25032 octavia_11.0.0-2+deb12u1.debian.tar.xz 378d3ca8e639c7fe9fd04844c8552fc28e7a3582 22124 octavia_11.0.0-2+deb12u1_amd64.buildinfo Checksums-Sha256: 17c0cb834da5e7a0ee69b6f8b2c4ce64f12d3e1f1adaa4a44b2fe2c0cc934e2b 4338 octavia_11.0.0-2+deb12u1.dsc a98db873c2c52602d24e4e5e9ceba58ae7f0db7d5e9ec26470a23ea1677a3e31 859312 octavia_11.0.0.orig.tar.xz d18263628d53bb6cd47af1097f3666d1f903be5e9aaf1afe90859e967235011b 25032 octavia_11.0.0-2+deb12u1.debian.tar.xz 1c8a3dd481ee6b84f4a363c53e01068c0ce49a627de51608c0f1ac66278a2101 22124 octavia_11.0.0-2+deb12u1_amd64.buildinfo Files: 8c9267ec5213a9b3e340b2675896691a 4338 net optional octavia_11.0.0-2+deb12u1.dsc 491a116d4bd755efea86ce1bbc68dd9c 859312 net optional octavia_11.0.0.orig.tar.xz 313eabeed9d2ce9e9d61a2785bd0bad6 25032 net optional octavia_11.0.0-2+deb12u1.debian.tar.xz 8f38ec84371b3c48e42e4f11256ed6e5 22124 net optional octavia_11.0.0-2+deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrxpnIACgkQ1BatFaxr Q/6fuxAAj8yzKnw9wcnvgpylxQcF+YLpxCyRZjpnAn9WJcyU2py08U1I0s5PWUHu EYLxqpTJUwxos+EzXmaoRxwARANhcgyPV23NuHyGWAgN4Hb6OQ/VLU5DqNkh/jFa SqdL9kXV8Sx2e+5ouwuYSVGGXRqFTIEy2Z5/c1ZPWP1+NBQ+VGfCS0eyRg0LTJ6K FNwYD50fFQNyTFSlXRWdm1MNw9UQVadhLJ10ECecvD5ad8YO+swQQDr0WWDnzBbg ubswEMZc4KFc66hwqwsnicGrLv4TK7tEQxv313329lHwhx2KX0mRPZ6hceeEHbPz xwcc+J+m0udvlaTUMleVsYVRFp1tUoB+ZyUVaq91C+yG0kulxVy8+RjV3ELu9aE5 9xvb2UxA1vmVhWFDRVDu9/05ntK79szENKeJU+VrkcuRyWUU18pM4uKepXX0Hi8c ofl0kAiErUgsV4bBov8IehtReD7Rj01Op9mRAd8ySYHRrixEr1ntXZgGP2G/S0Pe C8/8lk/Z8fNVjlcTqKlsAGqLqBKqRFKjdG0KewknvujLrohxr+QNyIO1DTUou42A g6T7lBTKaRFrSIN+HIj82oOm1aND9IGBonac6LyUF6Vvs+wCj2lkXw6pGAG/YrjC Mox0KPEO80pd4S1X0QJ8eCiCFMGA6BkfTAmYyXq10k1AhK4nyzk= =mDIs -----END PGP SIGNATURE-----
