Описание
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
A flaw was discovered in the OpenStack Object Storage service (swift) TempURLs. An attacker in possession of a TempURL key with PUT permissions could gain read access to other objects in the same project (tenant).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Gluster Storage 3.1 | swiftonfile | Not affected | ||
| Red Hat Storage 2.1 | gluster-swift | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | openstack-swift | Fixed | RHSA-2015:1895 | 15.10.2015 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | openstack-swift | Fixed | RHSA-2015:1895 | 15.10.2015 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | openstack-swift | Fixed | RHSA-2015:1895 | 15.10.2015 |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | openstack-swift | Fixed | RHSA-2015:1895 | 15.10.2015 |
| Red Hat Gluster Storage 3.1 for RHEL 6 | openstack-swift | Fixed | RHSA-2016:0329 | 01.03.2016 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | openstack-swift | Fixed | RHSA-2016:0328 | 01.03.2016 |
Показывать по
Дополнительная информация
Статус:
4.3 Medium
CVSS2
Связанные уязвимости
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obta ...
4.3 Medium
CVSS2