Debian Patches

Status for octavia/11.0.0-2+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
install-missing-files.patch Install missing files Thomas Goirand <zigo@debian.org> not-needed 2018-12-16
remove-sphinxcontrib.rsvgconverter-from-doc.patch Remove sphinxcontrib.rsvgconverter from doc
===================================================================		 Thomas Goirand <zigo@debian.org> no 2019-09-30
add-a-healthcheck-url.patch Add a /healthcheck URL from oslo.middleware
This patch adds a /healtcheck URL so that operators can configure haproxy
in a nicer way for Octavia.		 Thomas Goirand <zigo@debian.org> no 2020-06-16
use-octavia-agent-lvs-masquerade-not-lvs-masquerade.sh.patch Use packaged version of octavia-agent-lvs-masquerade Thomas Goirand <zigo@debian.org> no 2021-09-20
make-it-work-with-haproxy-2.6.patch Update diskimage-create.sh to use noble as default This patch updates the image build process to use Ubuntu noble as the
default distribution.
It also removes the http-use-htx option that is now on by default and no
longer a valid configuration option.

===================================================================		 Michael Johnson <johnsomor@gmail.com> no upstream, https://review.opendev.org/c/openstack/octavia/+/970341 2026-04-24
CVE-2026-74248_OSSA-2026-035_Fix_QoS_policy_validation_to_use_request_context.patch Fix QoS policy validation to use request context The qos_policy_exists validation was using service credentials
instead of the user's request context when querying Neutron for
QoS policies. This allowed users to reference QoS policies from
other tenants when creating or updating a load balancer.
.
Pass the request context through qos_policy_exists, get_qos_policy,
and down to _get_resource so that Neutron enforces tenant scoping.

===================================================================		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1000295 2026-08-19
CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injection_via_tls_ciphers_field.patch Fix HAProxy config injection via tls_ciphers field The tls_ciphers field on listeners and pools was not validated for
control characters, allowing injection of arbitrary HAProxy
configuration directives by embedding spaces or newlines in the cipher
string.
.
Add input validation at the API layer to reject cipher strings
containing characters outside the set allowed by OpenSSL cipher
strings. Also add a safety check at config generation time to detect
and replace invalid values that may already exist in the database,
falling back to the configured default ciphers.

===================================================================		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1001096 2026-11-09
CVE-2026-94571_CVE-2026-94572_Fix_HAProxy_config_injection_via_L7_policy_redirect_URLs.patch Fix HAProxy config injection via L7 policy redirect URLs The redirect_url and redirect_prefix fields on L7 policies were
vulnerable to HAProxy configuration injection. The rfc3986 URL
validator encodes control characters (e.g. newlines to %0A) before
validating, so they passed structural checks. However, Octavia
stores the raw unencoded input and writes it directly into the
HAProxy configuration file, allowing injection of arbitrary
directives.
.
Add a check in the URL validator to reject URLs containing control
characters and spaces before they reach rfc3986. Also add a safety
check at config generation time to clear invalid redirect URLs that
may already exist in the database.

===================================================================		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1001097 2026-11-09
CVE-2026-94571_CVE-2026-94572_Fix-HAProxy-config-injection-via-L7-rule-regex-value.patch Fix HAProxy config injection via L7 rule regex values The value field of L7 rules with the REGEX compare type was only
validated for regular expression compilability, allowing injection of
arbitrary HAProxy configuration directives by embedding newlines in the
rule value. The value is rendered verbatim into an "acl" line of a
frontend/backend section, so the newline breaks out of the section,
where a "global" section can be declared with a "program" command that
is executed as uid=0 by the master process.
.
Add input validation at the API layer to reject regular expression
values containing control characters. Also add a safety check at config
generation time to skip rules with invalid values that may already
exist in the database.

===================================================================		 Thomas Goirand <zigo@debian.org> no debian upstream 2026-11-09

All known versions for source package 'octavia'

Links