------------------------------------------------------------------------- Debian LTS Advisory DLA-4801-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Carlos Henrique Lima Melara September 29, 2026 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : swift Version : 2.30.1-0+deb12u3 CVE ID : CVE-2026-71191 CVE-2026-97149 Debian Bug : 1142972 1148834 Two vulnerabilities were discovered in Swift, OpenStack's object storage service, that could lead to information disclosure. CVE-2026-71191 / OSSA-2026-030 An authorization bypass in the S3API middleware: client-supplied native Swift control headers (X-Copy-From(-Account), X-Symlink-Target(-Account), X-Object-Manifest, X-Static-Large-Object) were not stripped from client requests, allowing a user to bypass S3 ACL checks; sensitive SigV4 x-amz headers were also not required to be signed. CVE-2026-97149 / OSSA-2026-041 A user holding a PUT tempurl for an object could add an X-Copy-From header to the request to copy any other object within the account, resulting in cross-container information disclosure. Such requests now get a 400 response. For Debian 12 bookworm, these problems have been fixed in version 2.30.1-0+deb12u3. We recommend that you upgrade your swift packages. For the detailed security status of swift please refer to its security tracker page at: https://security-tracker.debian.org/tracker/swift Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature