Hello,
I have just uploaded swift 2.30.1-0+deb12u3 to bookworm-security. Could
someone from the LTS team please issue the DLA?
Here is a draft announcement text:
-----------------------------------------------------------------------
Package : swift
Version : 2.30.1-0+deb12u3
CVE ID : CVE-2026-71191 CVE-2026-97149
Debian Bug : 1142972 1148834
Two vulnerabilities were discovered in Swift, OpenStack's object
storage service.
CVE-2026-71191 / OSSA-2026-030
An authorization bypass in the S3API middleware: client-supplied
native Swift control headers (X-Copy-From(-Account),
X-Symlink-Target(-Account), X-Object-Manifest, X-Static-Large-Object)
were not stripped from client requests, allowing a user to bypass S3
ACL checks; sensitive SigV4 x-amz headers were also not required to
be signed.
CVE-2026-97149 / OSSA-2026-041
A user holding a PUT tempurl for an object could add an X-Copy-From
header to the request to copy any other object within the account,
resulting in cross-container information disclosure. Such requests
now get a 400 response.
For Debian 12 bookworm, these problems have been fixed in version
2.30.1-0+deb12u3.
We recommend that you upgrade your swift packages.
For the detailed security status of swift please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/source-package/swift
Further information about Debian LTS security advisories, how to
apply these updates to your system and frequently asked questions
can be found at: https://wiki.debian.org/LTS
-----------------------------------------------------------------------
For the upstream security notes, see OSSA-2026-030 and OSSA-2026-041 at:
https://security.openstack.org/ossa/OSSA-2026-041.html
https://security.openstack.org/ossa/OSSA-2026-031.html
Cheers,
Thomas Goirand (zigo)
