Version in base suite: 2.35.1-0+deb13u3 Base version: swift_2.35.1-0+deb13u3 Target version: swift_2.35.1-0+deb13u4 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/swift/swift_2.35.1-0+deb13u3.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/swift/swift_2.35.1-0+deb13u4.dsc changelog | 15 ++ patches/CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch | 55 ++++++++++ patches/series | 1 rules | 2 tests/unittests | 2 5 files changed, 73 insertions(+), 2 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpbbcv6a9d/swift_2.35.1-0+deb13u3.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpbbcv6a9d/swift_2.35.1-0+deb13u4.dsc: no acceptable signature found diff -Nru swift-2.35.1/debian/changelog swift-2.35.1/debian/changelog --- swift-2.35.1/debian/changelog 2026-08-17 09:01:41.000000000 +0000 +++ swift-2.35.1/debian/changelog 2026-09-24 13:30:56.000000000 +0000 @@ -1,3 +1,18 @@ +swift (2.35.1-0+deb13u4) trixie-security; urgency=medium + + * CVE-2026-97149 / OSSA-2026-041: TempURL PUT with an X-Copy-From + header reads another container (cross-container information + disclosure). Applied upstream patch: + - CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tem....patch + ("tempurl: Disallow X-Copy-From on tempurl requests") + (Closes: #1148834). + * Blacklist two more non-deterministic tests of the same family as the + already blacklisted test_operations_timing_stats_with_incr_timeout: + - test_operations_timing_stats_with_get_timeout + - test_operations_timing_stats_with_set_timeout + + -- Thomas Goirand Thu, 24 Sep 2026 15:30:56 +0200 + swift (2.35.1-0+deb13u3) trixie-security; urgency=medium * CVE-2026-71191 / OSSA-2026-030: Swift S3API header authorization bypass. diff -Nru swift-2.35.1/debian/patches/CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch swift-2.35.1/debian/patches/CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch --- swift-2.35.1/debian/patches/CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch 1970-01-01 00:00:00.000000000 +0000 +++ swift-2.35.1/debian/patches/CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch 2026-09-24 13:30:56.000000000 +0000 @@ -0,0 +1,55 @@ +Author: Christian Schwede +Date: Thu, 10 Sep 2026 15:41:44 +0200 +Description: CVE-2026-97149 / OSSA-2026-041: tempurl: Disallow X-Copy-From on tempurl requests + Disallow clients using the X-Copy-From header to make a copy of any + object within the account using a PUT tempurl by adding the x-copy-from + header to DISALLOWED_INCOMING_HEADERS. Requests that use the header now + get a 400 response, like the requests that use X-Object-Manifest or + X-Symlink-Target. + . + X-Copy-From-Account is not in the list, similar to + X-Symlink-Target-Account. These headers have no effect without + X-Copy-From or X-Symlink-Target. +Change-Id: Ibe98ae41cba42997bbba00c74bb24bee22f32c05 +Signed-off-by: Christian Schwede +(cherry picked from commit 32943ef7b9691f0447c3cfa93bb2f492958283a3) +Bug: https://launchpad.net/bugs/2166876 +Bug-Debian: https://bugs.debian.org/1148834 +Origin: Upstream, https://review.opendev.org/c/openstack/swift/+/1007050 +Last-Update: 2026-09-24 + +diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py +index 0d1ff26..4bec147 100644 +--- a/swift/common/middleware/tempurl.py ++++ b/swift/common/middleware/tempurl.py +@@ -318,7 +318,7 @@ + from swift.common.wsgi import WSGIContext + + +-DISALLOWED_INCOMING_HEADERS = 'x-object-manifest x-symlink-target' ++DISALLOWED_INCOMING_HEADERS = 'x-object-manifest x-symlink-target x-copy-from' + + #: Default headers to remove from incoming requests. Simply a whitespace + #: delimited list of header names and names can optionally end with '*' to +diff --git a/test/unit/common/middleware/test_tempurl.py b/test/unit/common/middleware/test_tempurl.py +index d2c886e..23d1ec1 100644 +--- a/test/unit/common/middleware/test_tempurl.py ++++ b/test/unit/common/middleware/test_tempurl.py +@@ -1016,14 +1016,15 @@ + self.assertIn(b'Temp URL invalid', resp.body) + self.assertIn('Www-Authenticate', resp.headers) + +- def test_disallowed_header_object_manifest(self): ++ def test_disallowed_headers(self): + self.tempurl = tempurl.filter_factory({})(self.auth) + expires = int(time() + 86400) + path = '/v1/a/c/o' + key = b'abc' + for method in ('PUT', 'POST'): + for hdr, value in [('X-Object-Manifest', 'private/secret'), +- ('X-Symlink-Target', 'cont/symlink')]: ++ ('X-Symlink-Target', 'cont/symlink'), ++ ('X-Copy-From', 'private/secret')]: + hmac_body = ('%s\n%i\n%s' % + (method, expires, path)).encode('utf-8') + sig = hmac.new(key, hmac_body, hashlib.sha256).hexdigest() diff -Nru swift-2.35.1/debian/patches/series swift-2.35.1/debian/patches/series --- swift-2.35.1/debian/patches/series 2026-08-17 09:01:41.000000000 +0000 +++ swift-2.35.1/debian/patches/series 2026-09-24 13:30:56.000000000 +0000 @@ -10,3 +10,4 @@ CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch +CVE-2026-97149_OSSA-2026-041_tempurl_Disallow_X-Copy-From_on_tempurl_requests.patch diff -Nru swift-2.35.1/debian/rules swift-2.35.1/debian/rules --- swift-2.35.1/debian/rules 2026-08-17 09:01:41.000000000 +0000 +++ swift-2.35.1/debian/rules 2026-09-24 13:30:56.000000000 +0000 @@ -62,7 +62,7 @@ rm debian/tmp/usr/bin/swift-init # https://review.opendev.org/c/openstack/swift/+/904601 ifeq (,$(findstring nocheck, $(DEB_BUILD_OPTIONS))) - pkgos-dh_auto_test --no-py2 --test-path test/unit 'test\.unit\.(?!common\.test_utils\.TestUtils\.test_get_logger_sysloghandler_plumbing|common\.middleware\.test_cname_lookup\.TestCNAMELookup.*|common\.test_db\.TestDatabaseBroker\.test_get.*|container\.test_sync\.TestContainerSync\.test_init.*|common\.test_utils\.TestPunchHoleReally\.test_punch_a_hole.*|common\.test_utils\.Test_LibcWrapper\.test_argument_plumbing.*|common\.test_utils\.TestUtils\.test_load_pkg_resource_importlib.*|common\.test_db_replicator\.TestHandoffsOnly.*|common\.ring\.test_builder\.TestGetRequiredOverload\.test_perfect_four_zone_four_replica_bad_placement|common\.test_wsgi\.TestWSGI.*|obj\.test_expirer\.TestObjectExpirer\.test_delete_actual_object|common\.test_memcached\.TestMemcached\.test_get_conns_hostname6|common\.test_memcached\.TestMemcached\.test_get_conns_v6|common\.test_memcached\.TestMemcached\.test_get_conns_v6_default|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_with_duplicate_but_sufficient_frag_indexes|proxy\.test_mem_server\.TestProxyServer\.test_statsd_prefix|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_read_timeout|proxy\.controllers\.test_base\.TestGetOrHeadHandler\.test_disconnected_logging|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|obj\.test_replicator\.TestObjectReplicator\.test_update|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_timeout|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_no_problems_no_hard_disconnect|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_incr_timeout|obj\.test_expirer\.TestExpirerHelpers\.test_embed_expirer_bytes_from_diskfile_metadata|common\.middleware\.test_proxy_logging\.TestProxyLogging\.test_init_statsd_options_access_log_prefix|common\.middleware\.test_proxy_logging\.TestProxyLogging\.test_init_statsd_options_log_prefix|common\.test_wsgi\.TestServersPerPortStrategy\.test_stale_pid_loading|common\.test_wsgi\.TestWorkersStrategy\.test_stale_pid_loading|common\.utils\.test_logs\.TestUtilsLogs\.test_LoggerFileObject_recursion|container\.test_server\.TestNonLegacyDefaultStoragePolicy\.test_PUT_account_update|common\.middleware\.s3api\.test_s3request\.TestRequest\.test_sig_v4_strm_unsgnd_pyld_trl_checksum_hdr_unsupported|common\.middleware\.s3api\.test_s3request\.TestModuleFunctions\.test_get_checksum_hasher)' + pkgos-dh_auto_test --no-py2 --test-path test/unit 'test\.unit\.(?!common\.test_utils\.TestUtils\.test_get_logger_sysloghandler_plumbing|common\.middleware\.test_cname_lookup\.TestCNAMELookup.*|common\.test_db\.TestDatabaseBroker\.test_get.*|container\.test_sync\.TestContainerSync\.test_init.*|common\.test_utils\.TestPunchHoleReally\.test_punch_a_hole.*|common\.test_utils\.Test_LibcWrapper\.test_argument_plumbing.*|common\.test_utils\.TestUtils\.test_load_pkg_resource_importlib.*|common\.test_db_replicator\.TestHandoffsOnly.*|common\.ring\.test_builder\.TestGetRequiredOverload\.test_perfect_four_zone_four_replica_bad_placement|common\.test_wsgi\.TestWSGI.*|obj\.test_expirer\.TestObjectExpirer\.test_delete_actual_object|common\.test_memcached\.TestMemcached\.test_get_conns_hostname6|common\.test_memcached\.TestMemcached\.test_get_conns_v6|common\.test_memcached\.TestMemcached\.test_get_conns_v6_default|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_with_duplicate_but_sufficient_frag_indexes|proxy\.test_mem_server\.TestProxyServer\.test_statsd_prefix|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_read_timeout|proxy\.controllers\.test_base\.TestGetOrHeadHandler\.test_disconnected_logging|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|obj\.test_replicator\.TestObjectReplicator\.test_update|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_timeout|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_no_problems_no_hard_disconnect|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_incr_timeout|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_get_timeout|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_set_timeout|obj\.test_expirer\.TestExpirerHelpers\.test_embed_expirer_bytes_from_diskfile_metadata|common\.middleware\.test_proxy_logging\.TestProxyLogging\.test_init_statsd_options_access_log_prefix|common\.middleware\.test_proxy_logging\.TestProxyLogging\.test_init_statsd_options_log_prefix|common\.test_wsgi\.TestServersPerPortStrategy\.test_stale_pid_loading|common\.test_wsgi\.TestWorkersStrategy\.test_stale_pid_loading|common\.utils\.test_logs\.TestUtilsLogs\.test_LoggerFileObject_recursion|container\.test_server\.TestNonLegacyDefaultStoragePolicy\.test_PUT_account_update|common\.middleware\.s3api\.test_s3request\.TestRequest\.test_sig_v4_strm_unsgnd_pyld_trl_checksum_hdr_unsupported|common\.middleware\.s3api\.test_s3request\.TestModuleFunctions\.test_get_checksum_hasher)' endif override_dh_installinit: diff -Nru swift-2.35.1/debian/tests/unittests swift-2.35.1/debian/tests/unittests --- swift-2.35.1/debian/tests/unittests 2026-08-17 09:01:41.000000000 +0000 +++ swift-2.35.1/debian/tests/unittests 2026-09-24 13:30:56.000000000 +0000 @@ -16,6 +16,6 @@ for i in $(py3versions -vr 2>/dev/null) ; do rm -rf .stestr stestr init - PYTHON=python${i} stestr run --subunit --test-path test/unit 'test\.unit\.(?!common\.test_utils\.TestUtils\.test_get_logger_sysloghandler_plumbing|common\.middleware\.test_cname_lookup\.TestCNAMELookup.*|common\.test_db\.TestDatabaseBroker\.test_get.*|container\.test_sync\.TestContainerSync\.test_init.*|common\.test_utils\.TestPunchHoleReally\.test_punch_a_hole.*|common\.test_utils\.Test_LibcWrapper\.test_argument_plumbing.*|common\.test_utils\.TestUtils\.test_load_pkg_resource_importlib.*|common\.test_db_replicator\.TestHandoffsOnly.*|common\.test_db\.TestDatabaseBroker\.test_disk_preallocate|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|common\.middleware\.test_xprofile\.TestProfileMiddleware\.test_call|common\.ring\.test_builder\.TestGetRequiredOverload\.test_perfect_four_zone_four_replica_bad_placement|common\.test_wsgi\.TestWSGI.*|obj\.test_expirer\.TestObjectExpirer\.test_delete_actual_object|common\.test_memcached\.TestMemcached\.test_get_conns_hostname6|common\.test_memcached\.TestMemcached\.test_get_conns_v6|common\.test_memcached\.TestMemcached\.test_get_conns_v6_default|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_with_duplicate_but_sufficient_frag_indexes|common\.test_utils\.TestUtils\.test_get_logger_name_and_route|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|proxy\.test_mem_server\.TestProxyServer\.test_statsd_prefix|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_read_timeout|proxy\.controllers\.test_base\.TestGetOrHeadHandler\.test_disconnected_logging|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|obj\.test_replicator\.TestObjectReplicator\.test_update|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_timeout|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_no_problems_no_hard_disconnect|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_incr_timeout|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_disconnect|obj\.test_expirer\.TestExpirerHelpers\.test_embed_expirer_bytes_from_diskfile_metadata|common\.test_wsgi\.TestServersPerPortStrategy\.test_stale_pid_loading|common\.test_wsgi\.TestWorkersStrategy\.test_stale_pid_loading|common\.utils\.test_logs\.TestUtilsLogs\.test_LoggerFileObject_recursion|container\.test_server\.TestNonLegacyDefaultStoragePolicy\.test_PUT_account_update|common\.middleware\.s3api\.test_s3request\.TestRequest\.test_sig_v4_strm_unsgnd_pyld_trl_checksum_hdr_unsupported|common\.middleware\.s3api\.test_s3request\.TestModuleFunctions\.test_get_checksum_hasher)' | subunit2pyunit + PYTHON=python${i} stestr run --subunit --test-path test/unit 'test\.unit\.(?!common\.test_utils\.TestUtils\.test_get_logger_sysloghandler_plumbing|common\.middleware\.test_cname_lookup\.TestCNAMELookup.*|common\.test_db\.TestDatabaseBroker\.test_get.*|container\.test_sync\.TestContainerSync\.test_init.*|common\.test_utils\.TestPunchHoleReally\.test_punch_a_hole.*|common\.test_utils\.Test_LibcWrapper\.test_argument_plumbing.*|common\.test_utils\.TestUtils\.test_load_pkg_resource_importlib.*|common\.test_db_replicator\.TestHandoffsOnly.*|common\.test_db\.TestDatabaseBroker\.test_disk_preallocate|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|common\.middleware\.test_xprofile\.TestProfileMiddleware\.test_call|common\.ring\.test_builder\.TestGetRequiredOverload\.test_perfect_four_zone_four_replica_bad_placement|common\.test_wsgi\.TestWSGI.*|obj\.test_expirer\.TestObjectExpirer\.test_delete_actual_object|common\.test_memcached\.TestMemcached\.test_get_conns_hostname6|common\.test_memcached\.TestMemcached\.test_get_conns_v6|common\.test_memcached\.TestMemcached\.test_get_conns_v6_default|obj\.test_reconstructor\.TestWorkerReconstructor\.test_run_forever_recon_aggregation|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_with_duplicate_but_sufficient_frag_indexes|common\.test_utils\.TestUtils\.test_get_logger_name_and_route|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|proxy\.test_mem_server\.TestProxyServer\.test_statsd_prefix|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_read_timeout|proxy\.controllers\.test_base\.TestGetOrHeadHandler\.test_disconnected_logging|obj\.test_expirer\.TestObjectExpirer\.test_failed_delete_continues_on|obj\.test_replicator\.TestObjectReplicator\.test_update|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_timeout|obj\.test_ssync_receiver\.TestReceiver\.test_UPDATES_no_problems_no_hard_disconnect|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_incr_timeout|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_get_timeout|common\.test_memcached\.TestMemcached\.test_operations_timing_stats_with_set_timeout|proxy\.controllers\.test_obj\.TestECObjController\.test_GET_disconnect|obj\.test_expirer\.TestExpirerHelpers\.test_embed_expirer_bytes_from_diskfile_metadata|common\.test_wsgi\.TestServersPerPortStrategy\.test_stale_pid_loading|common\.test_wsgi\.TestWorkersStrategy\.test_stale_pid_loading|common\.utils\.test_logs\.TestUtilsLogs\.test_LoggerFileObject_recursion|container\.test_server\.TestNonLegacyDefaultStoragePolicy\.test_PUT_account_update|common\.middleware\.s3api\.test_s3request\.TestRequest\.test_sig_v4_strm_unsgnd_pyld_trl_checksum_hdr_unsupported|common\.middleware\.s3api\.test_s3request\.TestModuleFunctions\.test_get_checksum_hasher)' | subunit2pyunit stestr slowest done