Your message dated Tue, 20 Oct 2026 21:06:44 +0000
with message-id <[email protected]>
and subject line Bug#1151439: fixed in manila 1:23.0.0-4
has caused the Debian Bug report #1151439,
regarding CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project
public-share and export-metadata changes
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151439: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151439
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: manila
Version: 1:20.0.0-3
Severity: serious
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce here:
https://security.openstack.org/ossa/OSSA-2026-046.html
Date: October 20, 2026
:CVE: CVE-2026-71195
Affects
~~~~~~~
- Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0
Description
~~~~~~~~~~~
Chen YuXiang from the Institute of Computing Technology, Chinese Academy of
Sciences reported that a non-owner could modify access rules and
export-location metadata of another project's public share. Goutham Pacha
Ravi and Carlos da Silva from Red Hat identified further public-share paths:
a non-owner could soft-delete or restore a foreign public share, or create a
backup of it. A compatible storage backend may apply unauthorized changes to
existing access rules, disrupting access for the share's owner or authorized
users.
Separately, Yuliang Xiao reported that the export-location metadata API does
not scope its lookup to the share in the request. An authenticated project
member may therefore read, modify, or delete another project's export-location
metadata by supplying the target export-location UUID with the identifier of
a share they control. This issue is more easily exploitable with public
shares.
Deployments with public shares are affected by the public-share operations.
Deployments that utilize export-location metadata for shares are affected by
the metadata vulnerability.
Patches
~~~~~~~
- https://review.opendev.org/1011483 (2025.1/epoxy)
- https://review.opendev.org/1011482 (2025.2/flamingo)
- https://review.opendev.org/1011481 (2026.1/gazpacho)
- https://review.opendev.org/1011479 (2026.2/hibiscus)
- https://review.opendev.org/1011478 (2027.1/indri (development))
Credits
~~~~~~~
- Chen YuXiang from Institute of Computing Technology, Chinese Academy of
Sciences (CVE-2026-71195)
- Yuliang Xiao (CVE-2026-71195)
References
~~~~~~~~~~
- https://bugs.launchpad.net/manila/+bug/2161412
- https://bugs.launchpad.net/manila/+bug/2168962
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71195
Notes
~~~~~
- The companion Manila Tempest plugin update,
https://review.opendev.org/1011484, updates cross-project export-
location tests to expect 404 after the fix.
--
Goutham Pacha Ravi
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html
--- End Message ---
--- Begin Message ---
Source: manila
Source-Version: 1:23.0.0-4
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
manila, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated manila package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Oct 2026 22:36:10 +0200
Source: manila
Architecture: source
Version: 1:23.0.0-4
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1151439
Changes:
manila (1:23.0.0-4) unstable; urgency=high
.
* CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project
public-share and export-metadata changes. Applied upstream patch
"Fix policy control for public shares" (Closes: #1151439):
- CVE-2026-71195_Fix_policy_control_for_public_shares.patch
Checksums-Sha1:
c3f19276b1fe446f9c489ea8f110b94d01cb1f8d 3794 manila_23.0.0-4.dsc
6c06b2da57ef22d89b8ed5ac0518f5f50721095d 20240 manila_23.0.0-4.debian.tar.xz
b7c5b247ea8f4b2d522d87811e610efee3898efb 16263 manila_23.0.0-4_amd64.buildinfo
Checksums-Sha256:
71de522412cc443b9b5a9a25ff587415bfe94e26faf5777c3e0dde5b79b55057 3794
manila_23.0.0-4.dsc
3befec713cd6a98cb9345fc6968974809d8ebed65dd53e47942dbebf341f7b40 20240
manila_23.0.0-4.debian.tar.xz
cdddb6867d98d098d6dd3d63f83ddd055bc7a0d67209d33109141ebdeb8bb792 16263
manila_23.0.0-4_amd64.buildinfo
Files:
bdb9df046d36efca02cb5ac8c2e946a6 3794 net optional manila_23.0.0-4.dsc
e7470fd42656ab09088e401157bb1f67 20240 net optional
manila_23.0.0-4.debian.tar.xz
32bd3716de3ae34ca6c15b1bf6e3b4b5 16263 net optional
manila_23.0.0-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrX0gsACgkQ1BatFaxr
Q/4+FQ/+OzjwGKbMXirqa9sNzfit/obZMbPDW5JWZyWide4bgMrOdVkPNfBgxnVO
uD1t8xoNNNVS63/CgkfOYDijCcmbDd7Yl9h7Xd8223ykcbPyUjjgsk54g2n5tlBB
7s1I76/jXm8g3TNK/QJ++Keb8dlFw7m9Jsd+z7p8MXRCzMPnhvPAIpocZDX4dWZf
BSMr2rPoDIoB89dh7bMu4lgpxymO/EmF6NXNGXTmfEmX1YnO4cMmNLp7QDuFfguC
Gtlyf9ZGn0MhbtL/1C9pg/U7OopBR6+Y6djUpv3DC2vdJkpegJEnJUJGRzo4S3lh
qSTXr9nC2su4xScmYGW2lPru2BLU+V4bgP4QKzLFePbCC0+pTxJLKEDZVfkJ3Aqv
3LXrW01uVdYmujKgz+bU+f/FcswfSzHiWvqrI/+mw7wmJhSnHGHQFOUaHs4K3tXl
o4YUucxh9pR+cfAZVy2R05vuAk8CDjlKYF/1p0kPOu4/dnnKL3kqYISoAYEjHRnt
rgJLPDS9CZzeGY+oI60J/WaEgt7RlNUcE2Hs3Sz0EY/SvNAYaSdQLsMDEoAWGUZt
bV7VhBbpG4wSL5f+2JS1mpyMTOCAOUC5MkSLiunEPic3sNDQroybCV6CFXC9Dkl6
FVZzRlf/sgPOpnwErYvHkeZNHvEypu3mkJ6mjLywFdUCLEXx/8Y=
=Q/8w
-----END PGP SIGNATURE-----
pgpDPJneZsNar.pgp
Description: PGP signature
--- End Message ---
