Debian Patches

Status for octavia/18.0.0-4

Patch Description Author Forwarded Bugs Origin Last update
install-missing-files.patch Install missing files Thomas Goirand <zigo@debian.org> not-needed 2018-12-16
remove-sphinxcontrib.rsvgconverter-from-doc.patch Remove sphinxcontrib.rsvgconverter from doc
===================================================================		 Thomas Goirand <zigo@debian.org> no 2019-09-30
use-octavia-agent-lvs-masquerade-not-lvs-masquerade.sh.patch Use packaged version of octavia-agent-lvs-masquerade
===================================================================		 Thomas Goirand <zigo@debian.org> no 2021-09-20
compat-python3-cryptography-bookworm.patch Compat with bookworm's python3-cryptography
===================================================================		 Thomas Goirand <zigo@debian.org> no 2024-09-16
CVE-2026-74248_OSSA-2026-035_Fix_QoS_policy_validation_to_use_request_context.patch [PATCH] Fix QoS policy validation to use request context The qos_policy_exists validation was using service credentials
instead of the user's request context when querying Neutron for
QoS policies. This allowed users to reference QoS policies from
other tenants when creating or updating a load balancer.
.
Pass the request context through qos_policy_exists, get_qos_policy,
and down to _get_resource so that Neutron enforces tenant scoping.

===================================================================		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1000094 2026-08-19
Fix_HAProxy_config_injection_via_tls_ciphers_field.patch Fix HAProxy config injection via tls_ciphers field The tls_ciphers field on listeners and pools was not validated for
control characters, allowing injection of arbitrary HAProxy
configuration directives by embedding spaces or newlines in the cipher
string.
.
Add input validation at the API layer to reject cipher strings
containing characters outside the set allowed by OpenSSL cipher
strings. Also add a safety check at config generation time to detect
and replace invalid values that may already exist in the database,
falling back to the configured default ciphers.

diff --git a/octavia/common/jinja/haproxy/combined_listeners/jinja_cfg.py b/octavia/common/jinja/haproxy/combined_listeners/jinja_cfg.py
index 4aadb1d..94a5f0ab 100644		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1001091 2026-09-17
Fix_HAProxy_config_injection_via_L7_policy_redirect_URLs.patch Fix HAProxy config injection via L7 policy redirect URLs The redirect_url and redirect_prefix fields on L7 policies were
vulnerable to HAProxy configuration injection. The rfc3986 URL
validator encodes control characters (e.g. newlines to %0A) before
validating, so they passed structural checks. However, Octavia
stores the raw unencoded input and writes it directly into the
HAProxy configuration file, allowing injection of arbitrary
directives.
.
Add a check in the URL validator to reject URLs containing control
characters and spaces before they reach rfc3986. Also add a safety
check at config generation time to clear invalid redirect URLs that
may already exist in the database.

diff --git a/octavia/common/jinja/haproxy/combined_listeners/jinja_cfg.py b/octavia/common/jinja/haproxy/combined_listeners/jinja_cfg.py
index 94a5f0ab..03a8d79 100644		 Gregory Thiemonge <gthiemon@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/octavia/+/1001092 2026-09-16

All known versions for source package 'octavia'

Links