Debian Patches

Status for swift/2.37.1-6

Patch Description Author Forwarded Bugs Origin Last update
OSSA-2026-030_CVE-2026-pending1-stable-2026.1-v2_1.patch OSSA-2026-030: s3api: require signing of sensitive SigV4 x-amz headers SigV4 accepted unsigned x-amz-* headers alongside a valid signature, so a
presigned URL could be extended with e.g. an unsigned x-amz-copy-source.
Reject unsigned x-amz-* headers that change request semantics: copy, acl,
grant and meta (also covers x-amz-metadata-directive).
.
Narrow denylist for now; full x-amz-* signing (AWS parity) can follow.

diff --git a/swift/common/middleware/s3api/s3request.py b/swift/common/middleware/s3api/s3request.py
index c183be6b4..b3dff7fd9 100644		 Christian Schwede <cschwede@mailbox.org> yes debian upstream upstream, https://review.opendev.org/c/openstack/swift/+/998944 2026-07-22
OSSA-2026-030_CVE-2026-pending1-stable-2026.1-v2_2.patch CVE-pending1 s3api: drop native Swift control headers from client requests Strip client-supplied X-Copy-From(-Account), X-Symlink-Target(-Account),
X-Object-Manifest and X-Static-Large-Object before the Swift subrequest,
so they can't bypass S3 ACL checks. Headers s3api sets itself (e.g.
X-Copy-From from x-amz-copy-source) are added later and stay trusted.

diff --git a/swift/common/middleware/s3api/s3request.py b/swift/common/middleware/s3api/s3request.py
index b3dff7fd9..e07c60b94 100644		 Christian Schwede <cschwede@mailbox.org> yes debian upstream upstream, https://review.opendev.org/c/openstack/swift/+/998945 2026-07-22
OSSA-2026-031_CVE-2026-pending2-stable-2026.1.patch swob: avoid excessive backtracking in Accept parser Python's regex engine uses backtracking: when a later part of a match
fails, it goes back and tries other ways of matching earlier alternatives.
.
Swift parses Accept headers on account and container requests before
authentication. A small malformed header can keep a proxy worker at
100% CPU, with processing time growing roughly as phi^n for n consecutive
backslashes. One request per worker can make the proxy unavailable, and
disconnecting does not stop the ongoing regex evaluation.
.
In a quoted Accept parameter, backslashes could match either as normal
characters or as parts of escaped pairs. If the closing quote was missing,
Python tried every possible partition before rejecting the header.
.
Exclude backslashes from normal quoted text so they can only start an
escaped character. This removes the ambiguity and makes malformed
headers fail quickly while preserving valid escaped characters.

diff --git a/swift/common/swob.py b/swift/common/swob.py
index d6e653de2..9971bdc4f 100644		 Christian Schwede <cschwede@mailbox.org> yes debian upstream upstream, pre-OSSA list 2026-07-22
syslog_log_name.patch Set log_name for Swift services in default configs
===================================================================		 Ondřej Nový <novy@ondrej.org> not-needed 2016-07-05
disable_sphinxcontrib_rsvgconverter.patch Disable sphinxcontrib.rsvgconverter extension
===================================================================		 Ondřej Nový <novy@ondrej.org> not-needed 2020-02-12
set-default-workers-value.patch Set default workers value Since the package switched to uwsgi and now reads this value, it can't be
left as "auto" an commented out.

===================================================================		 Thomas Goirand <zigo@debian.org> not-needed 2020-10-30
Add_tempurl_path_prefix_configuration_option.patch Add [filter:tempurl]/path_prefix configuration option If swiftproxy endpoint is something like /object, with URL rewriting
by haproxy, then the hmac calculation is wrong.
.
This patch adds a new path_prefix directive which is stripped away
in the URLs before calculating the tempurl hmac.

===================================================================		 Kevin Allioli <kevin@linit.io> yes 2021-11-18
swift-recon-only-query-object-servers-once.patch swift-recon: only query object servers once
===================================================================		 Thomas Goirand <zigo@debian.org> no 2023-04-28
drive-full-checker.patch drive-full-checker The admin documentation provides a documentation on how to "prevent[ing]
disk full scenarios" over here:
https://docs.openstack.org/swift/latest/admin_guide.html#preventing-disk-full-scenarios
.
Even if the doc provides an actual example, this example is written in
Python 2, and its implementation is incomplete.
.
This patch intend to fill the gap, and allow administrator to use an
official implementation of a new "swift-drive-full-checker" tool from
/usr/bin directly. Once done, we intend to also patch puppet-swift to
use this new tool.

===================================================================		 Thomas Goirand <zigo@debian.org> yes 2024-02-11
fix-writing-non-ascii-in-headers-in-tests.patch Fix writing non-ascii in headers during tests
===================================================================		 Thomas Goirand <zigo@debian.org> no debian 2025-12-26
CVE-2026-49017_OSSA-2026-014_s3api_Error_on+truncated+aws-chunked_input.patch CVE-2026-49017/OSSA-2026-014: s3api: Error on truncated aws-chunked input When an aws-chunked request body ends in the middle of a chunk, the
underlying input should return b''. StreamingInput was appending that
empty buffer and re-reading forever.
.
Treat an empty chunk read before the terminal zero-byte chunk completes
the payload as incomplete input instead. Add parser-level and object PUT
regression tests for a client disconnecting mid-chunk.

diff --git a/swift/common/middleware/s3api/s3request.py b/swift/common/middleware/s3api/s3request.py
index 9f3641f..c183be6 100644		 Clay Gerrard <clay.gerrard@gmail.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/swift/+/990261 2026-04-28
CVE-2026-50221-stable-2026.1_Block-internal-update-headers-at-the-gatekeeper.patch CVE-2026-50221: Block internal update headers at the gatekeeper The proxy-server's gatekeeper middleware did not strip internal
container and expiry update headers (X-Container-Host,
X-Container-Device, X-Delete-At-Host, X-Delete-At-Device, and
related headers) from client requests. An authenticated user with
write access could inject these headers to redirect container
update requests, enabling server-side request forgery.
.
Strip these headers at the gatekeeper before they reach any
downstream middleware or the proxy-server application.
.

diff --git a/swift/common/middleware/gatekeeper.py b/swift/common/middleware/gatekeeper.py
index dfb5ef04b..8e2583202 100644		 Goutham Pacha Ravi <gouthampravi@gmail.com> yes debian upstream upstream, pre-OSSA mailing list 2026-06-10

All known versions for source package 'swift'

Links