Your message dated Tue, 18 Aug 2026 21:47:30 +0000
with message-id <[email protected]>
and subject line Bug#1143170: fixed in neutron 2:26.0.3-0+deb13u3
has caused the Debian Bug report #1143170,
regarding CVE-2026-55707 / OSSA-2026-032: Subnetpool onboarding cross-project
subnet mutation
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143170: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143170
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: neutron
Version: 2:26.0.3-0+deb13u2
Severity: grave
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-032.html
:Date: July 29, 2026
:CVE: CVE-2026-55707
Affects
~~~~~~~
- Neutron: >=14.0.0 <26.0.6, >=27.0.0 <27.0.4, >=28.0.0 <28.0.2
Description
~~~~~~~~~~~
Tim Shephard from roiai.ca reported a vulnerability in Neutron's subnetpool
onboarding API. A project member can onboard subnets from another project's
shared network into their own subnetpool, mutating the victim's persistent
subnet state and altering L3 routing, NAT, and address-scope behavior for
victim routers. Only deployments with shared or RBAC-shared networks and the
subnetpool onboarding extension enabled are affected.
Patches
~~~~~~~
- https://review.opendev.org/999134 (2025.1/epoxy)
- https://review.opendev.org/999133 (2025.2/flamingo)
- https://review.opendev.org/999132 (2026.1/gazpacho)
- https://review.opendev.org/999131 (2026.2/hibiscus (development))
Credits
~~~~~~~
- Tim Shephard from roiai.ca
References
~~~~~~~~~~
- https://launchpad.net/bugs/2152113
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55707
--
Goutham Pacha Ravi
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html
--- End Message ---
--- Begin Message ---
Source: neutron
Source-Version: 2:26.0.3-0+deb13u3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated neutron package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 03 Aug 2026 09:47:00 +0200
Source: neutron
Architecture: source
Version: 2:26.0.3-0+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1142937 1143170
Changes:
neutron (2:26.0.3-0+deb13u3) trixie-security; urgency=medium
.
* CVE-2026-55707: subnetpool onboarding cross-project subnet mutation.
Applied upstream fix: CVE-2026-55707-stable-2025.1.patch.
(Closes: #1143170).
* OSSN-0102: sub-resource APIs do not verify parent ownership. Applied
upstream patches (Closes: #1142937):
- "Fix PF GET/PUT parent floating IP validation".
- "Fix cross-project access to router conntrack helpers"
Checksums-Sha1:
2d67b747dd22de74daafbaa0110ef72823b30a26 5086 neutron_26.0.3-0+deb13u3.dsc
153a29dc30b55187ea6bb052e94cb48d012dc500 10241136 neutron_26.0.3.orig.tar.xz
db5a3ddd1005b90ceea8409f67b12d77a1ff95a1 51024
neutron_26.0.3-0+deb13u3.debian.tar.xz
c5a1a5701c24e48fe685cdba207ed3aa3cc8c052 23276
neutron_26.0.3-0+deb13u3_amd64.buildinfo
Checksums-Sha256:
245caa7ab2dc69a3ae51839307682c1e86766c7021dbf37a6cddf7dfdfb81bc8 5086
neutron_26.0.3-0+deb13u3.dsc
611e8b2e2aab1f6585bd426bcb91b94c3f88215d2913aa1158f6a604d448c1be 10241136
neutron_26.0.3.orig.tar.xz
214fcd5c30a791ef72170e06ce306528b165708de5c397ef94bc326d71851399 51024
neutron_26.0.3-0+deb13u3.debian.tar.xz
a202d21e8df4a39566b9a21c6d86e141061c82a543d09c360b59eda6d6f8af12 23276
neutron_26.0.3-0+deb13u3_amd64.buildinfo
Files:
f5dcebeee8b982d0eb023a6ccef124cb 5086 net optional neutron_26.0.3-0+deb13u3.dsc
605a4f7f503a30e367b766d6a903f853 10241136 net optional
neutron_26.0.3.orig.tar.xz
b6ef864b86ef5319db7f7e872256c7c2 51024 net optional
neutron_26.0.3-0+deb13u3.debian.tar.xz
e2a7b774dbb7492e9210a193275efe71 23276 net optional
neutron_26.0.3-0+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp65/IACgkQ1BatFaxr
Q/6s/BAAnvbo95qhu2o8210rJAd3EGecAfduUyPIjrAllqTb4HLKEo2OCw0FBzVL
i8DkqlRdxCPb3VtldS+IK5iPCaDWv1o/UhOCVU6eh5LUbt5id/37N060mZzuaxUF
QGkcN9kdw0lb+jXa+W7u/AY2XJTSxhzc0TBYDbj/KJrYk7j53XplHcg6N+I9Nxdk
1mz4BxvX3glUJYsSHmQOVzg5mXydS6z8O0cv6PUOWCpCBn21VGIOXRpjnXvdVmE2
dOz1a6IX0fvbQGuTwMQHAhlVbppr6RsiUaoial6vsyyJuUA0Sz7gOUiK4rUYXsS1
CxRWCf5aiUmsPttosa6aeV9rMWJjgyu0dRux7G1kadwWpzSEENnm3uVA6OWFOBVT
xQl4+IpcsAIAeMBOFgeDK60OeZYWprjRn4a2RUf9wzKjJt8v028pL9c2GNgHXjnT
XsDZr2oqUj9QSerdNVaUkB5sogcpU/RTAipHcTDHWiUnS70Y8l0zG7EfpXLqpMYR
rYXn1CCSDKy6REnZ6+b6ruTKfUhMflf9Vpgd8yLhKeY8T0pTFnl/hekJ5Ycp+lYf
BHjZaRHP6+MRo+WDIZHVfwn/+YQc2XUou0scg7FMFq6nxT3uAKXusuWgrkvf/Ios
cSUFLLlaWBHls32AE73UBkJf9JfmTkQknetHy3r+SdF1EEDwwj0=
=mLX3
-----END PGP SIGNATURE-----
pgp3Bs6uaAbW4.pgp
Description: PGP signature
--- End Message ---
