Bug 1209994 (CVE-2015-1856)

Summary: CVE-2015-1856 OpenStack Swift: unauthorized deletion of versioned Swift object
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, chrisw, dallan, derekh, gkotton, gmollett, lhh, lpeer, markmc, nlevinki, rbryant, rfortier, sclewis, security-response-team, sisharma, smohan, srevivo, ssaha, vbellur, zaitcev
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A flaw was found in OpenStack Object Storage that could allow an authenticated user to delete the most recent version of a versioned object regardless of ownership. To exploit this flaw, an attacker must know the name of the object and have listing access to the x-versions-location container.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-23 06:47:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1246357, 1246358, 1246360, 1248348, 1248349    
Bug Blocks: 1209996    
Attachments:
Description Flags
cve-2015-1856-master-kilo.patch
none
cve-2015-1856-stable-icehouse.patch
none
cve-2015-1856-stable-juno.patch none

Description Vasyl Kaigorodov 2015-04-08 15:41:52 UTC 
Upstream reported the below vulnerability in OpenStack:
"""
Title: Unauthorized delete of versioned Swift object
Reporter: Clay Gerrard (SwiftStack)
Products: Swift
Affects: up to version 2.2.2

Description:
Clay Gerrard from SwiftStack reported a vulnerability in Swift object
versioning. An authenticated user can delete the most recent version of
any versioned object who's name is known if the user have listing access
to the x-versions-location container. Only Swift setups with
allow_version setting are affected.
"""

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Clay Gerrard of SwiftStack as the original reporter.
Comment 1 Vasyl Kaigorodov 2015-04-10 10:19:04 UTC 
Created attachment 1013074 [details]
cve-2015-1856-master-kilo.patch
Comment 2 Vasyl Kaigorodov 2015-04-10 10:19:08 UTC 
Created attachment 1013075 [details]
cve-2015-1856-stable-icehouse.patch
Comment 3 Vasyl Kaigorodov 2015-04-10 10:19:12 UTC 
Created attachment 1013076 [details]
cve-2015-1856-stable-juno.patch
Comment 5 Garth Mollett 2015-07-24 05:50:17 UTC 
Created openstack-swift tracking bugs for this issue:

Affects: fedora-all [bug 1246358]
Affects: openstack-rdo [bug 1246360]
Comment 7 errata-xmlrpc 2015-08-24 22:38:30 UTC 
This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2015:1681 https://rhn.redhat.com/errata/RHSA-2015-1681.html
Comment 8 errata-xmlrpc 2015-08-25 05:58:34 UTC 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6
  OpenStack 5 for RHEL 7

Via RHSA-2015:1684 https://rhn.redhat.com/errata/RHSA-2015-1684.html
Comment 9 Siddharth Sharma 2017-03-23 06:46:36 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2015:1845 https://rhn.redhat.com/errata/RHSA-2015-1845.html
Comment 10 Siddharth Sharma 2017-03-23 06:47:10 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2015:1846 https://rhn.redhat.com/errata/RHSA-2015-1846.html