)]}'
{"id":"openstack%2Fswift~994450","triplet_id":"openstack%2Fswift~stable%2F2026.1~I84b0b6878f0baef025000d047aa705ad241a3a13","project":"openstack/swift","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"6968":{"account":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"last_update":"2026-06-23 20:01:50.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-50221"],"change_id":"I84b0b6878f0baef025000d047aa705ad241a3a13","subject":"gatekeeper: Block X-Container-Host and other update headers from clients","status":"MERGED","created":"2026-06-23 15:00:35.000000000","updated":"2026-06-23 20:04:26.000000000","submitted":"2026-06-23 20:01:50.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"994450","meta_rev_id":"b8938f8d56edab031c2b20bd83abcb6b2c90e712","_number":994450,"virtual_id_number":994450,"owner":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-23 20:01:50.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-23 15:21:09.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-06-23 16:37:53.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-23 15:00:35.000000000","updated_by":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"reviewer":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"state":"CC"},{"updated":"2026-06-23 15:21:09.000000000","updated_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"reviewer":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"state":"REVIEWER"},{"updated":"2026-06-23 15:38:16.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-06-23 16:14:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"d2992280b97766f7402fa59d14deed1e741685f8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"date":"2026-06-23 15:00:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"cd091cb71536490963e5dc872fe969c494efa3a8","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-06-23 15:09:52.000000000","message":"Hashtag added: CVE-2026-50221","accounts_in_message":[],"_revision_number":1},{"id":"de1331b86330f7710943a2ec5ae3f277c3da6ddb","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2026-06-23 15:21:09.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"db74eefa1700e97137b7c40e1d047ad9cb2cfbcf","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 15:38:16.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9bbe668d01684e4e961d2813a451a2a7\n\n- swift-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/877cc49df5f747eb90ecc57123f60b23 : SUCCESS in 34m 21s","accounts_in_message":[],"_revision_number":1},{"id":"a866add7e54ecdb7357eda78418ae40bef7f3685","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 16:14:09.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4c332a2f055f49a6873e4bfdb50be1dd\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1288792fee5d4732a4bbe092cc707d3e : SUCCESS in 10m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9a33708e504246c0bc718d11006ebb65 : SUCCESS in 8m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/09c8a2e027a84ff1a3eb31adc7e34c54 : SUCCESS in 1h 01m 52s\n- grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/a5afb63784d746859aecace88cc748a3 : SUCCESS in 32m 38s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/74b39db5ba0b49f69debe6d4c5e53daa : SUCCESS in 35m 03s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/07e48158502b48a1b00a93fb096f28e8 : SUCCESS in 33m 48s\n- swift-tox-func-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/3048df044b714b3787bb84cd576f2d3b : SUCCESS in 11m 39s (non-voting)\n- swift-tox-func-encryption-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/b4725185c3444ccaadfc73cc70c628a4 : SUCCESS in 19m 09s (non-voting)\n- swift-tox-func-ec-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/0d250ef644eb44e5b135ffc8e890bae6 : SUCCESS in 22m 24s (non-voting)\n- swift-build-image https://zuul.opendev.org/t/openstack/build/61a8fb7909ed4bd795703af6874238f9 : SUCCESS in 6m 59s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/bdd6b9e453904f33bf4f7ad3d079223a : SUCCESS in 20m 11s\n- swift-tox-py310 https://zuul.opendev.org/t/openstack/build/331970ca5d8e40dc946a56a2db511690 : SUCCESS in 20m 42s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/9dc0ec7d531343c7b4af92f1cc59f76e : SUCCESS in 31m 14s\n- swift-tox-py314 https://zuul.opendev.org/t/openstack/build/ff6aef1ce3b34fd49d0f394ff91a45cc : SUCCESS in 10m 26s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/d53827544c6e4421b144955491b2d6b2 : SUCCESS in 15m 50s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/39d060ec938b4716884be5d715d21c1e : SUCCESS in 8m 16s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/eaa3aafa7e1942e7a8e01ec8e3c93085 : SUCCESS in 8m 56s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/5582adc7b1fe449ea8c78414ce68b5fa : SUCCESS in 9m 27s\n- swift-tox-func-ceph-s3tests-tempauth https://zuul.opendev.org/t/openstack/build/36fa5f7c0a72487fa3f05e34d9217f76 : SUCCESS in 9m 10s (non-voting)\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/4fa55576829a4b68a4fab42b82e1ce69 : SUCCESS in 8m 21s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/a3945218d8f347119d1e05631e4f95b0 : SUCCESS in 59m 27s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/6ebb6deba95544f48de663efbc07d774 : SUCCESS in 25m 18s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/31ef759542a44ea99544bfffca73ea49 : SUCCESS in 56m 47s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/9ce08ac694bd479c8366211c1ea8859b : SUCCESS in 20m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/52a2e9af50a84d889aac2f3ea9a22084 : SUCCESS in 3m 02s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/f4a61f1346f64db98dc72138b20945d1 : SUCCESS in 11m 49s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ffb822d442fb45dfbf881c8ea19a21fd : SUCCESS in 35m 24s","accounts_in_message":[],"_revision_number":1},{"id":"7e341ded0ef5e055fb72d2a472947a570c0a7309","author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"date":"2026-06-23 16:37:53.000000000","message":"Patch Set 1: Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"bd6e89f04ce7cecebc887f28eb0658efed1d1c2c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 16:39:51.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"1276697a9aae59694d6cbfb16b7e2cd1721d2cf4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:01:50.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4255b3ed45ed4b3ba6a49f2069442a3a\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/db482512ea1d46f99b81efbf7a40fd9e : SUCCESS in 11m 37s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eafecf0b58b6480d86d484c20136cf1b : SUCCESS in 5m 03s\n- grenade https://zuul.opendev.org/t/openstack/build/b695c6d9597c4861a021f3dfbbcc0cbc : SUCCESS in 1h 03m 46s\n- grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/0244aa282bf04a489b88e44ca2dc1dcc : SUCCESS in 1h 05m 31s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/657aa28b76de4a909ee95576916d9170 : SUCCESS in 36m 33s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/4845697290b742e29fdc6d460b0727fc : SUCCESS in 1h 09m 31s\n- swift-upload-image https://zuul.opendev.org/t/openstack/build/5b748829927640f585747ac4058cf8b1 : SUCCESS in 8m 33s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/44695bf594b14a5b870e86c420b73a6d : SUCCESS in 20m 41s\n- swift-tox-py310 https://zuul.opendev.org/t/openstack/build/89454cb6a8534b14b0dbde4702c5da58 : SUCCESS in 10m 56s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/dcc86ed88a8d47fc8f6137063236b49f : SUCCESS in 26m 12s\n- swift-tox-py314 https://zuul.opendev.org/t/openstack/build/e874df39020a4fd08615d3fec0706ed8 : SUCCESS in 17m 29s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/08745e3fffbe427a85de0690b3ace13d : SUCCESS in 13m 04s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/d297f19cc8b94da2a15803686132d63e : SUCCESS in 14m 45s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/15d4def7c63d4e119357395c07ef49e4 : SUCCESS in 9m 46s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/99e20a45b32d4bd6b6487c015e9eff72 : SUCCESS in 16m 12s\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/ffe02bc04d0a4d51be9e6ec6fb82f962 : SUCCESS in 10m 41s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/01ab46a1cb874bfbab16ac976ccad669 : SUCCESS in 48m 49s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/b7790a36b42f4f3c9c66bda4203c92f9 : SUCCESS in 47m 51s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/f9e7ebf2a0ad4152a1b78e25abfa1e5a : SUCCESS in 55m 20s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/5104524eef2048d0b73f5cdc9a1f69d8 : SUCCESS in 29m 12s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c35a1b067b104a8c8c3361534d526f7b : SUCCESS in 4m 49s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/51f9001ffef84f49ad6bf87f13f9597d : SUCCESS in 18m 51s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/52735cedd90d4e008adf5bba084f6125 : SUCCESS in 35m 17s","accounts_in_message":[],"_revision_number":1},{"id":"20f81b5fc8ce8df110860cf2fd57c4d4f0c37653","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:01:50.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"b8938f8d56edab031c2b20bd83abcb6b2c90e712","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-23 20:04:26.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6db823afccfd4554934f84293bd870b1\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/afae25dc298d4868bb627be0e68cea13 : SUCCESS in 53s\n- swift-promote-image https://zuul.opendev.org/t/openstack/build/b39d0aed28b843a285c73d4061bdd31b : SUCCESS in 47s (non-voting)","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"51051ff3a0528bf996006e2c2833bd992da3ac3e","revisions":{"51051ff3a0528bf996006e2c2833bd992da3ac3e":{"kind":"REWORK","_number":1,"created":"2026-06-23 15:00:35.000000000","uploader":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"ref":"refs/changes/50/994450/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/50/994450/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/994450/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/994450/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/994450/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/50/994450/1"}}},"commit":{"parents":[{"commit":"110eb050ad24730a1421258cc33279f337ef9343","subject":"Harden pickle unmarshalling","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/110eb050ad24730a1421258cc33279f337ef9343"}]}],"author":{"name":"Tim Burke","email":"tim.burke@gmail.com","date":"2026-05-12 21:57:34.000000000","tz":-420},"committer":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-06-23 14:54:17.000000000","tz":120},"subject":"gatekeeper: Block X-Container-Host and other update headers from clients","message":"gatekeeper: Block X-Container-Host and other update headers from clients\n\nThere are a variety of headers that get used by object-servers to\nupdate container-servers or by container-servers to update\naccount-servers. None of them start with X-Backend- (they predated that\nnamespace), and previously were not blocked by the gatekeeper. As a\nresult, a malicious client could direct the object-server to send\nupdates to unintended locations.\n\nNow, block all update-related X-Account-*, X-Container-*, and\nX-Delete-At-* headers at the gatekeeper.\n\nFixes: CVE-2026-50221\nCloses-Bug: #2150261\nChange-Id: I84b0b6878f0baef025000d047aa705ad241a3a13\nSigned-off-by: Tim Burke \u003ctim.burke@gmail.com\u003e\nSigned-off-by: Christian Schwede \u003ccschwede@mailbox.org\u003e\n(cherry picked from commit 75b050fdb1d1a6096f3765faa3b2059e28065d13)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/51051ff3a0528bf996006e2c2833bd992da3ac3e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/51051ff3a0528bf996006e2c2833bd992da3ac3e"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}