Swift: unauthorized deletion of versioned Swift object
Published Apr 17, 2015
5.5
MEDIUMCVSS 2.0
EPSS 3.95%
Description
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Affected products
No data.
Configuration 2
- 12.04
- 14.04
- 15.04
No data.
Native Client for RHEL 6 for Red Hat Storage
glusterfs-0:3.7.1-16.el6
Fixed · RHSA-2015:1845
Native Client for RHEL 7 for Red Hat Storage
glusterfs-0:3.7.1-16.el7
Fixed · RHSA-2015:1846
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6
openstack-swift-0:1.13.1-6.el6ost
Fixed · RHSA-2015:1684
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7
openstack-swift-0:1.13.1-5.el7ost
Fixed · RHSA-2015:1684
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7
openstack-swift-0:2.2.0-4.el7ost
Fixed · RHSA-2015:1681
Red Hat Gluster Storage 3.1 for RHEL 6
gdeploy-0:1.0-12.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
gluster-nagios-addons-0:0.2.5-1.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
gluster-nagios-common-0:0.2.2-1.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
glusterfs-0:3.7.1-16.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
gstatus-0:0.65-1.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
nagios-server-addons-0:0.2.2-1.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
nfs-ganesha-0:2.2.0-9.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
openstack-swift-0:1.13.1-6.el6ost
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
redhat-storage-server-0:3.1.1.0-2.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
swiftonfile-0:1.13.1-5.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 6
vdsm-0:4.16.20-1.3.el6rhs
Fixed · RHSA-2015:1845
Red Hat Gluster Storage 3.1 for RHEL 7
gdeploy-0:1.0-12.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
gluster-nagios-addons-0:0.2.5-1.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
gluster-nagios-common-0:0.2.2-1.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
glusterfs-0:3.7.1-16.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
gstatus-0:0.65-1.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
nagios-server-addons-0:0.2.2-1.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
nfs-ganesha-0:2.2.0-9.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
openstack-swift-0:1.13.1-6.el7ost
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
redhat-storage-server-0:3.1.1.0-2.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
swiftonfile-0:1.13.1-5.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Gluster Storage 3.1 for RHEL 7
vdsm-0:4.16.20-1.3.el7rhgs
Fixed · RHSA-2015:1846
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
glusterfs-0:3.7.1-16.el7
Fixed · RHSA-2015:1846
Red Hat OpenStack Platform 4
openstack-swift
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Native Client for RHEL 6 for Red Hat Storage | glusterfs-0:3.7.1-16.el6 | Fixed | RHSA-2015:1845 |
| Native Client for RHEL 7 for Red Hat Storage | glusterfs-0:3.7.1-16.el7 | Fixed | RHSA-2015:1846 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | openstack-swift-0:1.13.1-6.el6ost | Fixed | RHSA-2015:1684 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | openstack-swift-0:1.13.1-5.el7ost | Fixed | RHSA-2015:1684 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | openstack-swift-0:2.2.0-4.el7ost | Fixed | RHSA-2015:1681 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | gdeploy-0:1.0-12.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | gluster-nagios-addons-0:0.2.5-1.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | gluster-nagios-common-0:0.2.2-1.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | glusterfs-0:3.7.1-16.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | gstatus-0:0.65-1.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | nagios-server-addons-0:0.2.2-1.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | nfs-ganesha-0:2.2.0-9.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | openstack-swift-0:1.13.1-6.el6ost | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | redhat-storage-server-0:3.1.1.0-2.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | swiftonfile-0:1.13.1-5.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | vdsm-0:4.16.20-1.3.el6rhs | Fixed | RHSA-2015:1845 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | gdeploy-0:1.0-12.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | gluster-nagios-addons-0:0.2.5-1.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | gluster-nagios-common-0:0.2.2-1.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | glusterfs-0:3.7.1-16.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | gstatus-0:0.65-1.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | nagios-server-addons-0:0.2.2-1.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | nfs-ganesha-0:2.2.0-9.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | openstack-swift-0:1.13.1-6.el7ost | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | redhat-storage-server-0:3.1.1.0-2.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | swiftonfile-0:1.13.1-5.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | vdsm-0:4.16.20-1.3.el7rhgs | Fixed | RHSA-2015:1846 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | glusterfs-0:3.7.1-16.el7 | Fixed | RHSA-2015:1846 |
| Red Hat OpenStack Platform 4 | openstack-swift | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (21)
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163113.html vendor-advisoryx_refsource_FEDORA
- http://lists.openstack.org/pipermail/openstack-announce/2015-April/000349.html mailing-listx_refsource_MLISTVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html vendor-advisoryx_refsource_SUSE
- http://rhn.redhat.com/errata/RHSA-2015-1681.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2015-1684.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2015-1845.html vendor-advisoryx_refsource_REDHAT
- http://rhn.redhat.com/errata/RHSA-2015-1846.html vendor-advisoryx_refsource_REDHAT
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html x_refsource_CONFIRM
- http://www.securityfocus.com/bid/74182 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2704-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2015-1856 Vendor Advisory
- https://bugs.launchpad.net/swift/+bug/1430645 x_refsource_CONFIRMVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1209994 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3554 Advisory
- https://git.openstack.org/cgit/openstack/swift/commit/?id=5bb7c286ebb4a54e4d2bd5a02845644d1c651183
- https://git.openstack.org/cgit/openstack/swift/commit/?id=85afe9316570855c87ea731d0627f6f8f2b73264
- https://git.openstack.org/cgit/openstack/swift/commit/?id=dd9d97458ea007024220a78dba8dd663e8b425d7
- https://git.openstack.org/cgit/openstack/swift/commit/?id=f6525758ab2456d688430699338993439597a789
- https://github.com/advisories/GHSA-cc77-5vw4-7pwg Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2015-1856
- https://www.cve.org/CVERecord?id=CVE-2015-1856
Change history (0)
No recorded changes yet.