Hi,

[ Reason ]
I would like to upload Octavia octavia_16.0.0-3+deb13u1 to
p-u to address:
https://security.openstack.org/ossa/OSSA-2026-035.html
aka:
https://bugs.debian.org/1144814

[ Impact ]
As per upstream announce:
[there is] a vulnerability in Octavia quality of service (QoS) policy
authorization. By associating another project’s QoS policy with an amphora, an
authenticated user may prevent deletion of that policy. All Octavia deployments
are affected.

[ Tests ]
The patch includes tests. I have also ran the fixes through my own CI,
so I could run functional tests.

[ Risks ]
The patch only adds a "context" object here and there, it's kind of
comprehensive.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Just a new upstream patch to fix the issue.

Please allow me to upload octavia/16.0.0-3+deb13u1 to p-u.

Cheers,

Thomas Goirand (zigo)

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

Hi,

The version looks based on the wrong version? It should IMHO be on top
of the version in trixie, which is 16.0.0-2, not 16.0.0-3.

Regards,
Salvatore

Indeed, you're right, and also, the -3 version in my repository adds a
super bad bug where the Amphora falls into error, so it should
absolutely not be included.

I uploaded Octavia 16.0.0-2+deb13u1 to trixie p-u with the added patches
which address a very bad RCE vulnerability in the Amphora as well:

   * CVE-2026-94572, CVE-2026-94571:
     Octavia is vulnerable to an RCE in its amphora via the Octavia API.
     Added upstream patches (Closes: #1148175):
     - Fix_HAProxy_config_injection_via_tls_ciphers_field.patch
     - Fix_HAProxy_config_injection_via_L7_policy_redirect_URLs.patch

Please accept Octavia 16.0.0-2+deb13u1 into Trixie p-u. Debdiff attached
again, since it has been updated.

Cheers,

Thomas Goirand (zigo)