Your message dated Thu, 24 Sep 2026 12:34:24 +0000
with message-id <[email protected]>
and subject line Bug#1148834: fixed in swift 2.38.1-3
has caused the Debian Bug report #1148834,
regarding swift: [OSSA-2026-041] PUT TempURL plus X-Copy-From reads another
container (CVE-2026-97149)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148834: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148834
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: swift
Version: 2.38.1-2
Severity: grave
Tags: security upstream
Forwarded: https://bugs.launchpad.net/swift/+bug/2166876
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for swift.
CVE-2026-97149[0]:
| In OpenStack Swift before 2.38.2, the tempurl middleware does not
| reject the X-Copy-From header on PUT requests. A TempURL signature
| only covers the method, expiry, and path, and thus the list of
| disallowed headers is the only defense against a signed PUT request
| changing what the request does. An attacker holding a PUT TempURL
| for a single object can add an X-Copy-From header naming any object
| in the same account; the copy middleware copies that object to the
| destination, and the attacker then reads the victim's data back with
| a GET TempURL for the destination object. Copies across account
| boundaries are rejected. Only deployments using the shipped default
| proxy pipeline (tempurl and copy middleware) with account-level
| TempURL keys are affected.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-97149
https://www.cve.org/CVERecord?id=CVE-2026-97149
[1] https://bugs.launchpad.net/swift/+bug/2166876
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: swift
Source-Version: 2.38.1-3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
swift, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated swift package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 24 Sep 2026 13:24:52 +0200
Source: swift
Architecture: source
Version: 2.38.1-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1148834
Changes:
swift (2.38.1-3) unstable; urgency=high
.
* OSSA-2026-041 / CVE-2026-97149: TempURL PUT with an X-Copy-From
header reads another container (cross-container information
disclosure). Applied upstream patch:
- CVE-2026-97149_OSSA-2026-041-stable-2026.2.patch
("tempurl: Disallow X-Copy-From on tempurl requests")
(Closes: #1148834).
Checksums-Sha1:
22f2161c3e81c74ba06e2a0ad076a5e0d05e5adb 3193 swift_2.38.1-3.dsc
1152618fa1286e94d8e88025334ae6626a22fc1d 34892 swift_2.38.1-3.debian.tar.xz
96c5deb76c0aebaed4a392a96d50949a63c40c10 14073 swift_2.38.1-3_amd64.buildinfo
Checksums-Sha256:
36e2d3860cfe4acb08961ede776638808cf89aefca8dd39bec85d1d174d1db0c 3193
swift_2.38.1-3.dsc
f0755df787bd8b0fa9240f8b3112fb8a53266792d58db67ff0021ec4a9530e30 34892
swift_2.38.1-3.debian.tar.xz
afd22559761831f037a74b8bc2fc46f62be0e5fd55d7cca3acef585417dc6a68 14073
swift_2.38.1-3_amd64.buildinfo
Files:
a8213b919408a9a1624910cdb59e8324 3193 net optional swift_2.38.1-3.dsc
dc472b3d42be1b45a3c51c6ceac1cfd3 34892 net optional
swift_2.38.1-3.debian.tar.xz
6083158415a8f3999e93b8c2ae86fdc2 14073 net optional
swift_2.38.1-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmq1EjoACgkQ1BatFaxr
Q/6TdRAAmazPIwggw/IwEunfqg4MQbVuH2k/yc4aeGgmDGskzfdTPrLoLklzqKha
uFZsH0bta1FhrKkzczvJZE7OdUdSIe/E8vuw7N0/JOlFuF1OvfBi7zA1UN9fBm+7
u2FQYIHC5R7dQVb09Z3y2dNF5OXKfNcQC+f+lUYAMHNzjZow8nUEwtMcrUmEk9in
2Can2Gso8Nb2L9p1XrZ4ozbc5AdzGGkBIShwc/3Ii1rSh5XGSiZG9nbO1vLWW+RW
YvBy/7h/wP9ecuHJd0jAeF9cimfEWo9/3bv+rDWleb7DNuwnf4b3bH+6DZFONAKm
5yqdOJw0tFsgB+XHb/95Br5NfDlkl9uteBppDscV8EqhH36NLe9CyJhzpgQX/ew4
dyFAgUpyMbsRKjY8wJDkgYEkCDuD1F6QbCjkAfPxdW4tH9xn4MswsQjQ8+J5ZBtU
52RIfIDmmeNaC5ks+PQyCPKt1NdFkPhMn+F3GfAMioarB4BAIXxog3905UneoQpT
Cx+aQz+kcKd+XsnisMcYwYibcHI4JDcRNtm7R1eXY98eI+MRiyK9EKkznTpqQXKq
MuSiSPu6f5r+lBQmdFB/Vkh6rV48l0eTCgaRYdTVC1prltoLwYjVmmO4HIDUndk/
nP5xOHq3tA6Jjp03T5AdiSuZsnQ7Mu/J9Mg8ZghiRdzB4OYJAVU=
=XNqS
-----END PGP SIGNATURE-----
pgpTEVG98VA4Z.pgp
Description: PGP signature
--- End Message ---
