-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 21 Aug 2025 09:10:49 +0200
Source: nova
Architecture: source
Version: 2:31.0.0-6+deb13u1
Distribution: trixie
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1111689
Changes:
nova (2:31.0.0-6+deb13u1) trixie; urgency=high
.
* A vulnerability has been identified in OpenStack Nova and OpenStack Watcher
in conjunction with volume swap operations performed by the Watcher
service. Under specific circumstances, this can lead to a situation where
two Nova libvirt instances could reference the same block device, allowing
accidental information disclosure to the unauthorized instance. Added
upstream patch: OSSN-0094_restrict_swap_volume_to_cinder.patch.
(Closes: #1111689).
* Blacklist non-deterministic unit test:
- ComputeTestCase.test_add_remove_fixed_ip_updates_instance_updated_at
Checksums-Sha1:
2520760e4876c58fdd32a3252a87cdc61320d587 4854 nova_31.0.0-6+deb13u1.dsc
d76e47f21f1704aa6933d13182d5feecf07a312a 70836 nova_31.0.0-6+deb13u1.debian.tar.xz
49787f19831d7cbc55a408f950db9be96a4fc648 25834 nova_31.0.0-6+deb13u1_amd64.buildinfo
Checksums-Sha256:
8bb27d885d948b426e478262bca1c257fba97a7d8aa9a4134237bb597154c7cc 4854 nova_31.0.0-6+deb13u1.dsc
bfe857aafd0e60da1b054e2f5d81e26ffcdd3d4c806d8a9d6c90b7ad48ed5fff 70836 nova_31.0.0-6+deb13u1.debian.tar.xz
1ac061ed0158e85484d0c21be5040c08b88a2214efb7cf364b2aa8b249aae04b 25834 nova_31.0.0-6+deb13u1_amd64.buildinfo
Files:
96107987b8aac8bfa60574a2016ed88f 4854 net optional nova_31.0.0-6+deb13u1.dsc
0999f4fe81c44a368ce0cb0b8d4948b0 70836 net optional nova_31.0.0-6+deb13u1.debian.tar.xz
03f40891a1e738b2969febe3d205e561 25834 net optional nova_31.0.0-6+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmkH2g4ACgkQ1BatFaxr
Q/4GZg//akrmNW9n3B9DnXsn1jmIqDnCyABbqgPp/2+QUjkwTKQe4y5rwUPBNVJV
hYRIqHUVCCUjacm4i9dH4LBNlp2yAexbMDUNuPqjxGkWAKLXRp+n6TUm1Gtq96If
pEVL6RK4UokaAUlBbmg4GUJsNNAFiJ46jXPr4wxe36C22R+C4GXh4xB+ufDekPto
38Sb/66XLvXg5b8qRJAjwC8vRhGf2OJeNBEZLJF08mlZNBqAUbaQQAKBMilAbq99
NATK/jRoIaZQznQ3Z1hdssAtB8x+WiOvnB7smosYb2yBJCLnjdRQPQfMRdCd1opM
af7CKBxxFKxFW0uGiBGLcr+hJKh5PvjeWrENARMyOZRK5jpG1NTRwMVtRZixtbU7
yQxIGysxdyUMT2x5TaH09czqRa8kE6EqUGl2x9nctjXTwUKIWZ4rmZIYUuy1svXY
qSM50BQ9gDCEHRnscZEUxAv/qSyf67KUwwKHDfLimwTXINRp3JJMde0lhuvbG8bd
NjeKro9dQHNVQFwSZsEdn5pjXYlgFrKHaydrD1eCzPMnbnk8SR5h1E+fZ/J38T2R
TX3lQJUbeQfMht16QGpgXOLo461poPFzZehc7+sq7RDXke1UNj8zFsHU4hgKuN1t
QyNXaiIhL5LJc6DZEO3TdAb81LWg6TS/9+qjy+1fc+2OkyRp2Vg=
=96De
-----END PGP SIGNATURE-----
Attachment:
pgpD5dolxVGFP.pgp
Description: PGP signature