Debian Patches

Status for cinder/2:29.0.0-3

Patch Description Author Forwarded Bugs Origin Last update
install-missing-files.patch Install missing files Thomas Goirand <zigo@debian.org> not-needed 2016-03-22
do-not-use-urllib3-from-botocore.patch Do not use urllib3 from botocore Cinder is using urllib3 vendored version from botocore, which we unvendor
in Debian.

===================================================================		 Thomas Goirand <zigo@debian.org> no 2026-09-12
add-params-thin_provisioning-equal-one.patch Add "params thin_provisioning=1" in tgt export Add 'params thin_provisioning=1' in iscsi volume export
to allow fstrim to work with the lvm backend.		 Thomas Goirand <zigo@debian.org> yes 2023-12-04
fix-db-schema-migration.patch Fix db schema migration This is a known issue documented here:
https://bugs.launchpad.net/cinder/+bug/2070475		 Thomas Goirand <zigo@debian.org> no 2024-11-20
Fix-evaluator-for-pyparsing-3.3.3.patch Restrict evaluator fn operator to actually implemented functions pyparsing 3.3.3 replaced the recursive implementation of infixNotation
with a shunting-yard parser, in which unary operators with
OpAssoc.RIGHT are now treated as generic prefix operators. The
evaluator grammar defined fn = Word(alphas + '_' + '.') as such an
operator to implement function calls, which now makes pyparsing
capture any bare identifier as a function applied to the rest of the
expression: dotted variable references such as stats.free_capacity_gb
or capabilities.foo, as well as the NOT keyword, can no longer be
substituted, breaking the DriverFilter and GoodnessWeigher, and
failing 14 unit tests at build time.
.
Restrict the fn operator to the only functions that the evaluator
implements (abs, max, min): any other name was already failing with a
KeyError at evaluation time, so this only affects the error path.
The parser now behaves identically with pyparsing 3.0.9, 3.1.2 and
3.3.3.

===================================================================		 yes debian 2026-10-11
CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch Fix cross-project information disclosure in the messages API Make the default for project_only=True in _messages_get_query() in the db
api, so a 'member'/'reader' user making the "List messages" call of the
Block Storage API v3.3 no longer sees other projects' non-expired user
messages in the response (CVE-2026-93856).

diff --git a/cinder/db/api.py b/cinder/db/api.py
index 100269396..ecd82fa05 100644		 Rajat Dhasmana <rajatdhasmana@gmail.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/cinder/+/1011487 2026-10-20

All known versions for source package 'cinder'

Links