)]}'
{"ossa/OSSA-2026-041.yaml":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"1aa465ea0bb27911c39c7c772e653afcd64447e0","unresolved":true,"context_lines":[{"line_number":11,"context_line":"  TempURL could resend the signed request with an ``X-Copy-From``"},{"line_number":12,"context_line":"  header naming any object in the same account, causing Swift to"},{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"f7a5f397_2d11a527","line":14,"range":{"start_line":14,"start_character":34,"end_line":14,"end_character":47},"updated":"2026-09-24 02:17:52.000000000","message":"Might be worth saying \"a second GET TempURL\", to clarify that you need two distinct TempURLs to get to disclosure. (Though I suppose the PUT URL would also work for HEADs... which would be enough to expose *metadata*, even if not the actual *data*...)","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"97e93fb4242347077f7086fd19c7d3428bcd08d5","unresolved":false,"context_lines":[{"line_number":11,"context_line":"  TempURL could resend the signed request with an ``X-Copy-From``"},{"line_number":12,"context_line":"  header naming any object in the same account, causing Swift to"},{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ad10564f_3c13a480","line":14,"range":{"start_line":14,"start_character":34,"end_line":14,"end_character":47},"in_reply_to":"f7a5f397_2d11a527","updated":"2026-09-24 05:24:28.000000000","message":"Acknowledged","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"1aa465ea0bb27911c39c7c772e653afcd64447e0","unresolved":true,"context_lines":[{"line_number":12,"context_line":"  header naming any object in the same account, causing Swift to"},{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"},{"line_number":18,"context_line":"  copy is limited to the account that owns the key, and the attacker"},{"line_number":19,"context_line":"  must know the target container and object name."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"e28fd1cf_2ef960f0","line":16,"range":{"start_line":15,"start_character":58,"end_line":16,"end_character":46},"updated":"2026-09-24 02:17:52.000000000","message":"\"Only deployments *with the tempurl middleware enabled*\" -- that involves more than just the default pipeline.","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"97e93fb4242347077f7086fd19c7d3428bcd08d5","unresolved":false,"context_lines":[{"line_number":12,"context_line":"  header naming any object in the same account, causing Swift to"},{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"},{"line_number":18,"context_line":"  copy is limited to the account that owns the key, and the attacker"},{"line_number":19,"context_line":"  must know the target container and object name."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"0ced4401_ef956fee","line":16,"range":{"start_line":15,"start_character":58,"end_line":16,"end_character":46},"in_reply_to":"e28fd1cf_2ef960f0","updated":"2026-09-24 05:24:28.000000000","message":"Acknowledged","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"1aa465ea0bb27911c39c7c772e653afcd64447e0","unresolved":true,"context_lines":[{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"},{"line_number":18,"context_line":"  copy is limited to the account that owns the key, and the attacker"},{"line_number":19,"context_line":"  must know the target container and object name."},{"line_number":20,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"da060635_ee2ac0e0","line":17,"range":{"start_line":16,"start_character":52,"end_line":17,"end_character":48},"updated":"2026-09-24 02:17:52.000000000","message":"Account-level tempurl keys are configured by users, not operators; an operator may not realize whether any users have account-level tempurl keys enabled. I think it would be safer to leave this off of the \"who\u0027s affected\" statement, but it might be good to call it out earlier -- maybe something like \"A party holding a single-object PUT TempURL *signed with an account-level key* could resend the signed request ...\"","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"97e93fb4242347077f7086fd19c7d3428bcd08d5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"  copy the named object into the granted destination object, and"},{"line_number":14,"context_line":"  read the copied bytes back with a GET TempURL, disclosing objects"},{"line_number":15,"context_line":"  the holder of the TempURL was not authorized to access. Only"},{"line_number":16,"context_line":"  deployments using the default proxy pipeline with account-level"},{"line_number":17,"context_line":"  tempurl keys (``X-Account-Meta-Temp-URL-Key``) are affected. The"},{"line_number":18,"context_line":"  copy is limited to the account that owns the key, and the attacker"},{"line_number":19,"context_line":"  must know the target container and object name."},{"line_number":20,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"e1a64f23_9289a9bf","line":17,"range":{"start_line":16,"start_character":52,"end_line":17,"end_character":48},"in_reply_to":"da060635_ee2ac0e0","updated":"2026-09-24 05:24:28.000000000","message":"Acknowledged","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"1aa465ea0bb27911c39c7c772e653afcd64447e0","unresolved":true,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"affected-products:"},{"line_number":29,"context_line":"  - product: swift"},{"line_number":30,"context_line":"    version: \u0027\u003e\u003d2.4.0 \u003c2.35.5, \u003e\u003d2.36.0 \u003c2.36.4, \u003e\u003d2.37.0 \u003c2.37.4, \u003e\u003d2.38.0 \u003c2.38.2\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"vulnerabilities:"},{"line_number":33,"context_line":"  - cve-id: CVE-2026-pending"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"cf92e860_2e3aaa15","line":30,"range":{"start_line":30,"start_character":14,"end_line":30,"end_character":21},"updated":"2026-09-24 02:17:52.000000000","message":"I strongly suspect that this dates back to 1.4.6, which introduced the tempurl middleware. Verifying that is difficult at this point, though.","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"97e93fb4242347077f7086fd19c7d3428bcd08d5","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"affected-products:"},{"line_number":29,"context_line":"  - product: swift"},{"line_number":30,"context_line":"    version: \u0027\u003e\u003d2.4.0 \u003c2.35.5, \u003e\u003d2.36.0 \u003c2.36.4, \u003e\u003d2.37.0 \u003c2.37.4, \u003e\u003d2.38.0 \u003c2.38.2\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"vulnerabilities:"},{"line_number":33,"context_line":"  - cve-id: CVE-2026-pending"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"4e352931_7d2bca6a","line":30,"range":{"start_line":30,"start_character":14,"end_line":30,"end_character":21},"in_reply_to":"cf92e860_2e3aaa15","updated":"2026-09-24 05:24:28.000000000","message":"Ack; I can set this (i located the commit 7fc1721d7 that added this) - thanks for flagging it. Typically, with an ancient bug like this, the accuracy of the lowest version seldom matters. Setting it serves to warn people that are closer to the community maintained release branches that a bug exists and they must patch it on their own if they don\u0027t intend to upgrade to a version we\u0027re shipping the fix in.","commit_id":"04e34cd651823c062cb492b6e0b50e46acb3f08b"}]}