swift - Debian Package Tracker

general

source: swift (main)
version: 2.38.2-2
maintainer: Debian OpenStack (DMD)
uploaders: Thomas Goirand [DMD] – Michal Arbet [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.26.0-10+deb11u1
o-o-sec: 2.26.0-10+deb11u2
oldstable: 2.30.1-0+deb12u1
old-sec: 2.30.1-0+deb12u3
stable: 2.35.1-0+deb13u2
stable-sec: 2.35.1-0+deb13u4
stable-p-u: 2.35.1-0+deb13u4
testing: 2.38.2-1
unstable: 2.38.2-2

versioned links

2.26.0-10+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.26.0-10+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.30.1-0+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.30.1-0+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.35.1-0+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.35.1-0+deb13u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.38.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.38.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-swift
swift
swift-account
swift-container
swift-doc
swift-drive-audit
swift-object
swift-object-expirer
swift-proxy

action needed

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2026-50221: In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.
CVE-2026-71190: In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
CVE-2026-71191: In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.
CVE-2026-71192: In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination. The attacker can read any object whose project_id, container name, and object name are known, regardless of the source object's ACLs or ownership. This requires the non-default s3_acl=true configuration.

Created: 2026-06-23 Last update: 2026-08-20 04:00

lintian reports 20 warnings normal

Lintian reports 20 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-01 Last update: 2026-10-11 22:31

3 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 149ef4b48fda2e17b3366698eea992945b3d20c9
Author: Thomas Goirand <thomas@goirand.fr>
Date:   Sun Oct 11 14:59:16 2026 +0200

    Depend on system Font Awesome in -doc package.
    
    The openstackdocstheme 3.2.0-4 based docs load the Font Awesome glyphs from the system files; add fonts-font-awesome-legacy | fonts-font-awesome to the -doc package's runtime depends so the icons render on any system.

commit f50b88ed25e4589c5580aabbb34ee81f9a8acb5f
Author: Thomas Goirand <thomas@goirand.fr>
Date:   Fri Oct 9 15:01:56 2026 +0200

    Drop stale swift-doc install-guide links.
    
    Docs built with openstackdocstheme 3.2.0-4 reference bootstrap.css
    and embed the system bootstrap 5 files; the bootstrap.min.css and
    bootstrap.min.js entries pointed at files which no longer exist and
    at a bootstrap 3 copy which would overwrite the correct embedded
    one. The doc-dir, jQuery and underscore symlinks stay.

commit 32b64544bda9881cfe540fc482b3dd4cde7d73b2
Author: Thomas Goirand <thomas@goirand.fr>
Date:   Fri Oct 9 00:25:48 2026 +0200

    salsa-ci.yml

Created: 2026-10-09 Last update: 2026-10-11 16:49

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-09-30 Last update: 2026-09-30 21:31

debian/patches: 2 patches to forward upstream low

Among the 7 debian patches available in version 2.38.2-2 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-11 23:30

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-71190: (needs triaging) In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-06-23 Last update: 2026-10-11 18:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.5.0).

Created: 2020-11-17 Last update: 2026-10-11 16:49

testing migrations

excuses:
- Migration status for swift (2.38.2-1 to 2.38.2-2): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for python-ceilometermiddleware/3.13.0-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for swift/2.38.2-2: amd64: Pass, arm64: Ignored failure ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered (failure will be ignored), ppc64el: Pass, riscv64: Pass, s390x: Ignored failure ♻ (reference ♻)
- ∙ ∙ Autopkgtest for swift-bench/2.0.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/s/swift.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-10-11] Accepted swift 2.38.2-2 (source) into unstable (Thomas Goirand)
[2026-10-06] swift 2.38.2-1 MIGRATED to testing (Debian testing watch)
[2026-10-02] Accepted swift 2.35.1-0+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-09-30] Accepted swift 2.38.2-1 (source) into unstable (Thomas Goirand)
[2026-09-27] Accepted swift 2.30.1-0+deb12u3 (source) into oldstable-security (Thomas Goirand)
[2026-09-27] swift 2.38.1-3 MIGRATED to testing (Debian testing watch)
[2026-09-26] Accepted swift 2.35.1-0+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-09-24] Accepted swift 2.38.1-3 (source) into unstable (Thomas Goirand)
[2026-09-20] Accepted swift 2.38.1-2 (source) into unstable (Thomas Goirand)
[2026-09-14] Accepted swift 2.38.1-1 (source) into experimental (Thomas Goirand)
[2026-08-24] Accepted swift 2.35.1-0+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-08-19] Accepted swift 2.30.1-0+deb12u2 (source) into oldstable-security (Thomas Goirand)
[2026-08-18] Accepted swift 2.35.1-0+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-08-02] swift 2.37.1-6 MIGRATED to testing (Debian testing watch)
[2026-07-29] Accepted swift 2.37.1-6 (source) into unstable (Thomas Goirand)
[2026-06-30] swift 2.37.1-5 MIGRATED to testing (Debian testing watch)
[2026-06-24] Accepted swift 2.37.1-5 (source) into unstable (Thomas Goirand)
[2026-06-13] swift 2.37.1-4 MIGRATED to testing (Debian testing watch)
[2026-06-11] swift REMOVED from testing (Debian testing watch)
[2026-05-31] Accepted swift 2.35.1-0+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-05-31] Accepted swift 2.35.1-0+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Thomas Goirand)
[2026-05-31] swift 2.37.1-4 MIGRATED to testing (Debian testing watch)
[2026-05-28] Accepted swift 2.37.1-4 (source) into unstable (Thomas Goirand)
[2026-04-02] swift 2.37.1-3 MIGRATED to testing (Debian testing watch)
[2026-03-27] Accepted swift 2.37.1-3 (source) into unstable (Thomas Goirand)
[2026-03-27] Accepted swift 2.37.1-2 (source) into unstable (Thomas Goirand)
[2026-03-20] Accepted swift 2.37.1-1 (source) into experimental (Thomas Goirand)
[2026-03-16] Accepted swift 2.37.0-1 (source) into experimental (Thomas Goirand)
[2026-01-30] swift 2.36.0-8 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted swift 2.36.0-8 (source) into unstable (Thomas Goirand)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 20)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
l10n (-, 100)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.38.2-0ubuntu1
7 bugs (1 patch)
patches for 2.38.2-0ubuntu1