Описание
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causing a proxy worker to consume 100% CPU for an extended period. Because the regex evaluation runs at the C level, client disconnection does not interrupt the computation. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service for the Swift object storage cluster.
Отчет
Red Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) ship OpenStack Swift as the openstack-swift package. Deployments using the default proxy-server pipeline configuration are affected because the listing_formats middleware processes Accept headers before authentication. The vulnerability is accessible without authentication on account and container listing endpoints (GET/HEAD requests). In RHOSP deployments, operators who manage their own load balancer (HAProxy, nginx) can apply the header size limit mitigation described above as a temporary measure until the fix is backported. In RHOSO deployments, the Swift API sits behind an OpenShift-managed HAProxy with configuration limited to OCP route annotations, which do not support the header inspection rules needed for effective mitigation. For RHOSO, backporting the upstream fix is the only effective remediation.
Меры по смягчению последствий
Deploy a reverse proxy (such as HAProxy, nginx, or Apache httpd) in front of the Swift proxy server and configure it to limit the size of the Accept request header. A limit of 256 bytes is sufficient for all legitimate Accept header values used by Swift clients. For example, in HAProxy: use 'http-request deny if { req.hdr(accept) -m len gt 256 }'. In nginx: use 'large_client_header_buffers' to restrict header size. Alternatively, a WAF rule can be deployed to reject Accept headers containing backslash characters in quoted strings without a closing quote, though the header size limit is simpler and more robust. Note that Swift's built-in max_header_size (default 8192 bytes) does NOT mitigate this vulnerability because the exponential backtracking is triggered with as few as 27 backslash-character pairs (~54 bytes). In Red Hat OpenStack Services on OpenShift (RHOSO) environments, the Swift API is deployed behind an OpenShift-managed HAProxy load balancer. The available OCP route annotations do not support custom header inspection rules such as 'http-request deny if', making the header size limit approach not feasible. Rate limiting via route annotations (e.g., rate-limit-connections.rate-http) provides only partial protection, as a single crafted request can still lock a proxy worker for minutes, and attackers using multiple source IPs can bypass per-IP limits. Additionally, default rate limits cannot be shipped as a mitigation because they would break deployer configurations. For RHOSO deployments, applying the upstream patch backport is the only effective remediation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-swift-account | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-swift-base | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-swift-container | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-swift-object | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-swift-proxy-server | Will not fix | ||
| Red Hat OpenStack Platform 16.2 | openstack-swift | Affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-swift-account | Affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-swift-base | Affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-swift-container | Affected | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-swift-object | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
In OpenStack Swift through 2.38.0, the proxy server Accept header pars ...
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
EPSS
7.5 High
CVSS3