Debian Patches

Status for neutron/2:26.0.3-0+deb13u3

Patch Description Author Forwarded Bugs Origin Last update
fix-path-of-healthcheck_disable.patch Fix path of healthcheck_disable Thomas Goirand <zigo@debian.org> no 2022-11-14
OSSA-2026-016_Fix_plural_policy_names_in_tagging_controller_and_floatingip_policy.patch Fix plural policy names in tagging controller and floatingip policy The TaggingController.create() and update() methods enforce policy
action names using the plural collection key (e.g. create_networks:tags)
instead of the singular member name (e.g. create_network:tags). Since
the registered policy rules use the singular form, the unmatched plural
names fall through to oslo.policy's default rule, allowing project
readers to mutate tags on same-project resources.
.
Fix the delete_floatingips:tags policy rule name (should be singular
delete_floatingip:tags) and add a unit test that validates
_get_policy_action produces the correct singular form for all supported
resources and actions, and that each generated name matches an actually
registered policy rule.

diff --git a/neutron/conf/policies/floatingip.py b/neutron/conf/policies/floatingip.py
index 9a3eaaf..ae99279 100644		 Rodolfo Alonso Hernandez <ralonsoh@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/neutron/+/989376 2026-05-29
OSSA-2026-021_Fix_port_RBAC_policies_to_require_network_ownership.patch Fix port RBAC policies to require network ownership Several default port policies that require network ownership incorrectly
included PROJECT_MANAGER. That rule checks the port project_id, not
network ownership, so any project manager could perform those actions
on shared/RBAC networks where they do not own the network.
.
Remove PROJECT_MANAGER from the affected create/update port policies
and rely on NET_OWNER_MEMBER or ADMIN_OR_NET_OWNER_MEMBER instead.
Project managers who own the network remain authorized through the
default Keystone role implication chain (manager implies member).
.
Conflicts:
neutron/tests/unit/conf/policies/test_port.py
.

===================================================================		 Rodolfo Alonso Hernandez <ralonsoh@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/neutron/+/991523 2026-06-05
CVE-2026-55707-stable-2025.1.patch Prevent cross-project subnet onboard on shared networks Non-admin callers with visibility to a shared or RBAC network
could onboard subnets owned by another project into their own
subnetpool via ``onboard_network_subnets()``. This allowed the
caller to alter the address-scope and L3 routing state of the
network owner's routers.
.
Add a project ownership check that rejects non-admin requests
when the caller's ``project_id`` does not match the network's
``project_id``.

diff --git a/neutron/db/db_base_plugin_v2.py b/neutron/db/db_base_plugin_v2.py
index 9b559dc4e24..e1d2f425937 100644		 Rodolfo Alonso Hernandez <ralonsoh@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/neutron/+/999133 2026-07-31
OSSN-0102-Fix_PF_GET_PUT_parent_floating_IP_validation.patch OSSN-0102 Fix PF GET/PUT parent floating IP validation Verify the port-forwarding floating IP id matches the
child floating IP id so we satisfy the policy requirements
for GET and PUT operations.

diff --git a/neutron/services/portforwarding/pf_plugin.py b/neutron/services/portforwarding/pf_plugin.py
index 76d1b32..8957df1 100644		 Brian Haley <haleyb.dev@gmail.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/neutron/+/991778 2026-07-28
OSSN-0102_Fix_cross-project_access_to_router_conntrack_helpers.patch OSSN-0102: Fix cross-project access to router conntrack helpers Singleton conntrack helper API operations (GET/PUT/DELETE on
/routers/{router_id}/conntrack_helpers/{id}) authorized the request
against the URL ``router_id`` but loaded the helper by child ID only.
A project member with access to one router could therefore operate on
another tenant's helper by reusing its UUID in the path.
.
Validate that the loaded helper's ``router_id`` matches the URL
``router_id`` before returning, updating, or deleting it, following
the same pattern used for floating IP port forwarding sub-resources.

diff --git a/neutron/services/conntrack_helper/plugin.py b/neutron/services/conntrack_helper/plugin.py
index d05d1b8..88b7121 100644		 Rodolfo Alonso Hernandez <ralonsoh@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/neutron/+/990127 2026-07-28

All known versions for source package 'neutron'

Links