Source: swift Version: 2.38.1-2 Severity: grave Tags: security upstream Forwarded: https://bugs.launchpad.net/swift/+bug/2166876 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for swift. CVE-2026-97149[0]: | In OpenStack Swift before 2.38.2, the tempurl middleware does not | reject the X-Copy-From header on PUT requests. A TempURL signature | only covers the method, expiry, and path, and thus the list of | disallowed headers is the only defense against a signed PUT request | changing what the request does. An attacker holding a PUT TempURL | for a single object can add an X-Copy-From header naming any object | in the same account; the copy middleware copies that object to the | destination, and the attacker then reads the victim's data back with | a GET TempURL for the destination object. Copies across account | boundaries are rejected. Only deployments using the shipped default | proxy pipeline (tempurl and copy middleware) with account-level | TempURL keys are affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-97149 https://www.cve.org/CVERecord?id=CVE-2026-97149 [1] https://bugs.launchpad.net/swift/+bug/2166876 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
