Dear release team,

[ Reason ]
I'd like to update Nova to address CVE-2026-46448 / OSSA-2026-022
and OSSN-0101 (see bugs #1140149 and #1142113).

The security team informed me that they prefer for these fixes to be
pushed through p-u.

[ Impact ]
CVE-2026-46448 / OSSA-2026-022: Nova scheduler hint injection bypasses
Placement resource claims and scheduling constraints.

OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.

[ Tests ]
Building the Nova package includes running 16742 tests, some of which
were added specifically for the above fixes. On top of this, we've been
running the patched pacakges (truth: in another OpenStack release) in
production. Also, I'm constantly running the upstream functional tests
suite.

[ Risks ]
Patches are very small, if one doesn't consider new tests. It's narly
one-liners.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
2 patches.

Please allow me to upload:
nova_31.0.0-6+deb13u3_source.changes
to Trixie p-u.

Cheers,

Thomas Goirand (zigo)

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

AFAICS this needs now to be rebased on the most current version in
trixie, and the version bumped to 2:31.0.0-6+deb13u3.

Regards,
Salvatore

Hi Salvatore,

I believe that's not correct and that the next version of Nova in Trixie
should be 2:31.0.0-6+deb13u2, which I just uploaded. Let me know if I'm
wrong.

Adam, uploaded, please approve.

Cheers,

Thomas Goirand (zigo)

That's wrong. trixie already has deb13u2, which was copied from trixie-security
during the last point release from [1].

So your update should be versioned deb13u3, and should include the changes in
that trixie-security upload to not lose them.

In fact, according to rmadison, there's already a deb13u3 in stable-new, not
sure who uploaded that or what changes it contains.

nova       | 2:31.0.0-6+deb13u2 | stable       | source
nova       | 2:31.0.0-6+deb13u3 | stable-new   | source

Cheers,
Emilio

[1] https://lists.debian.org/debian-security-announce/2026/msg00054.html

Hi Emilio,

Not sure how I got so confused in my messages, though I believe my
actions were right. I uploaded 2:31.0.0-6+deb13u3, which is still in
"stable-new" and needs to be approved to fix CVE-2026-46448 and
OSSN-0101. Please approve it.

Cheers,

Thomas Goirand (zigo)