-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 15 Jun 2026 09:34:33 +0200 Source: nova Architecture: source Version: 2:26.2.2-1~deb12u5 Distribution: bookworm-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1140149 1142113 Changes: nova (2:26.2.2-1~deb12u5) bookworm-security; urgency=medium . * CVE-2026-46448 / OSSN-2026-022: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints. Applied upstream patch: "Strip internal _nova-prefixed scheduler hints on create" (Closes: #1140149). * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). Checksums-Sha1: 2d362ab424a14635b69d94f2cbdf9f5b156b5873 5096 nova_26.2.2-1~deb12u5.dsc a6796c58f74ec57267a33af7b0db4e63e6bfb552 6000800 nova_26.2.2.orig.tar.xz e51b7b3dc63c799cd96cba2a8e92417039a1e293 92432 nova_26.2.2-1~deb12u5.debian.tar.xz 99c681a128d2d0b6369903844244e00bac70d3b4 23749 nova_26.2.2-1~deb12u5_amd64.buildinfo Checksums-Sha256: 31daa5c7768e29b4f972d34438a9e44e6d155d23cfe22654162b3bfb25155ee8 5096 nova_26.2.2-1~deb12u5.dsc d0fab415e15bfa70089b22e094d88ed3c7b66df0742bec52b4d9ff789e347571 6000800 nova_26.2.2.orig.tar.xz 8343d6180cca255643d9e5c2f114f8fdc649246a5e1a70f10782c5cba3d94c9f 92432 nova_26.2.2-1~deb12u5.debian.tar.xz a57e705596a0ded45e6b4622c3c075c87b19be6de31697d446aed0db9deea935 23749 nova_26.2.2-1~deb12u5_amd64.buildinfo Files: f1130b0f94e0bbd005dab2adf7a0b010 5096 net optional nova_26.2.2-1~deb12u5.dsc fddc994a8d3d81c2c41a93eafad1ea29 6000800 net optional nova_26.2.2.orig.tar.xz 09fec34f0a4f3b1ac474debef2e58993 92432 net optional nova_26.2.2-1~deb12u5.debian.tar.xz c7b3b90b7dfd38b39bb2d43a553f7d3c 23749 net optional nova_26.2.2-1~deb12u5_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmr1xGgACgkQ1BatFaxr Q/7vVQ/9HCeDUVHq3oCgK2WsAiIKNnu2KqtmBp/RV/PoqrCXy+f8GcUL6tpGzf2j qHGh/yXl2/J3RFLfRhZDTksm8uKzCr1dWMJTDvoNQ+XOtl4WGxbMo5AUYAXJ9mFF FR4o28ucBiFNlp/vQttMQp3DEpmXu9frQhzfwW0XWCveXQ/UwGoktuPZARYgiKwL z1t41HR2Yu+anUwJVD8yJIZQaLW46JpCU/HEzlbgL3MWIKV0TuriCnj6vQv735nK iYvmPu76kAAEhndFFW55+tZq30YY/SdSCG1TvkqehU1ZkfEPGeVOpvP/rNbHfcub QCskFKWJpM6zeM22xqmEsr14dgwvDqS95ZswfjLIAWisN8MiZQzK3o6bP7BSB7FJ zU+toUUE9+QURFyq+88M7mBDJLDCRFqy8XTbaEgAikcEMDh6bi8x01Pu7BoSUt2Q wgY14wn9usTFll6FSPVny+3Toyulb8Av26e17c8knlhry0sFmpt6+hCV/AHtSIHt 10wSw5KlGp1CHf0XSemkatLsdhLO+0viU0H6ECgnUUg6t7d780jLcCQue8TkYiZC UH22r2MNacJyxqQeof1V7h3s51DFmIE+3QA3Vx/OGBgQbLlacj/s8TAmRF5rQWqb aUlRWwld2zaVbK+Zdw1VXp4ivxzqbgVltt2MLiPxkASgu2WF958= =nuC9 -----END PGP SIGNATURE-----
