Dear LTS team,
As per my own policy, I always wait for approved upload in either
stable-security or stable p-u. Since a few packages were accepted in
proposed-update for Trixie, I also updated the fixes for Bookworm.
This includes:
- nova 2:26.2.2-1~deb12u5
- dnspython 2.3.0-1+deb12u1
- octavia 11.0.0-2+deb12u1
- watcher 9.0.0-2+deb12u1
- aodh 15.0.0-3+deb12u1
Below, the changelog entries for these uploads (rewrapped for this message).
Can someone make the corresponding Bookworm DLA for me?
nova (2:26.2.2-1~deb12u5) bookworm-security; urgency=medium
* CVE-2026-46448 / OSSN-2026-022: Nova scheduler hint injection
bypasses Placement resource claims and scheduling constraints.
Applied upstream patch: "Strip internal _nova-prefixed scheduler
hints on create" (Closes: #1140149).
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
Applied upstream patch: "Fix mutating global config in websocket
proxy" (Closes: #1142113).
-- Thomas Goirand <[email protected]> Mon, 15 Jun 2026 09:34:33 +0200
dnspython (2.3.0-1+deb12u1) bookworm; urgency=medium
* Backport upstream fix for CVE-2026-114605: limit DNS compression
pointer chains to 16 hops to prevent excessive CPU use (denial of
service) when parsing untrusted wire-format messages
(Closes: #1151842):
- 0001-Limit-decompression-to-a-chain-length-of-at-most-16-.patch
-- Thomas Goirand <[email protected]> Fri, 06 Nov 2026 13:41:34 +0100
octavia (11.0.0-2+deb12u1) bookworm-security; urgency=medium
* CVE-2026-74248 / OSSA-2026-035: Unauthorized QoS policy deletion
lock. Applied upstream patch: "Fix QoS policy validation to use
request context". (Closes: #1144814).
* CVE-2026-94571, CVE-2026-94572 / OSSA-2026-039:
Octavia is vulnerable to an RCE in its amphora via the Octavia API.
Added upstream patches (Closes: #1148175):
- CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injectio....patch
- CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injectio....patch
- CVE-2026-94571_CVE-2026-94572_Fix-HAProxy-config-injectio....patch
* Add make-it-work-with-haproxy-2.6.patch: remove the deprecated
http-use-htx option, unsupported by haproxy 2.6 as shipped in
Bookworm.
-- Thomas Goirand <[email protected]> Mon, 09 Nov 2026 11:40:05 +0100
watcher (9.0.0-2+deb12u1) bookworm-security; urgency=medium
* A vulnerability has been identified in OpenStack Nova and OpenStack
Watcher in conjunction with volume swap operations performed by the
Watcher service. Under specific circumstances, this can lead to a
situation where two Nova libvirt instances could reference the same
block device, allowing accidental information disclosure to the
unauthorized instance. Added upstream patch:
- OSSN-0094_use_cinder_migrate_for_swap_volume.patch.
(Closes: #1111692).
* CVE-2026-76878 / OSSA-2026-036: Watcher webhook trigger endpoint
does not enforce oslo.policy authorization. Any authenticated user
who learns a Watcher audit webhook URL can POST to the webhook to
trigger an administrator-owned EVENT audit and its associated action
plan, regardless of the caller's project or role. The webhook
endpoint has lacked policy enforcement since its introduction in the
Ussuri release. Applied upstream patch: "Add policy enforcement to
webhook trigger endpoint". (Closes: #1144880)
* Blacklist 2 tests:
- watcher.tests.common.test_service.TestService.test_start
- watcher.tests.common.test_service.TestService.test_stop
* Add python3-ddt as build-depends, needed for this patch.
-- Thomas Goirand <[email protected]> Thu, 21 Aug 2025 13:39:32 +0200
aodh (15.0.0-3+deb12u1) bookworm-security; urgency=high
* CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce
project scope when the all_projects query parameter is present with
a false value. A non-admin project reader can list alarms belonging
to other projects by passing all_projects=false in a list query,
optionally combined with a foreign project_id to target a specific
project. Leaked alarm data includes trust webhook URLs, Heat signal
endpoints, and project identifiers. Applied upstream patch: "Fix
all_projects=false bypass project scope" (Closes: #1144879).
* Fix the all_projects=true alarm listing returning HTTP 500: the
CVE-2026-76878 backport passed pecan.request to rbac.enforce while
this branch's old API expects the HTTP headers. Adapted the patch:
- CVE-2026-76878-aodh-lp-2161276-2025.1.patch
* lp-2167496: Fix an authorization bypass in the alarm listing API
where duplicated project_id query filters could bypass project
scope: authorization validated the first filter value while the
storage query kept the last one, letting a non-admin user list
another project's alarms, including action URLs. Applied upstream
patch: "Duplicated query fields are now rejected with a 400
response" (Closes: #1153094):
- lp-2167496_Fix_duplicate_project_id_query_filter_bypass_p....patch
-- Thomas Goirand <[email protected]> Wed, 12 Aug 2026 10:09:50 +0200
