Bug 1298905 (CVE-2016-0738)

Summary: CVE-2016-0738 openstack-swift: Proxy to server DoS through Large Objects
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aavati, abaron, aortega, apevec, ayoung, chrisw, dallan, derekh, gkotton, gmollett, jjoyce, jrusnack, jschluet, kbasil, lhh, lpeer, markmc, mburns, nlevinki, osoukup, rbryant, rfortier, sclewis, security-response-team, sgirijan, sisharma, slinaber, slong, smohan, srevivo, ssaha, tdecacqu, tshefi, vbellur, yeylon, zaitcev
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A memory-leak issue was found in OpenStack Object Storage (swift), in the proxy-to-server connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-01 10:31:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1299668, 1299669, 1299670, 1299671, 1299672, 1300612, 1300613, 1308476    
Bug Blocks: 1298929, 1312737    
Attachments:
Description Flags
Master/mitaka patch
none
Stable/kilo patch
none
Stable/liberty patch none

Description Adam Mariš 2016-01-15 12:10:22 UTC
A DoS vulnerability in openstack-swift was reported. By repeatedly requesting and interrupting connections to a Large Object (Dynamic or Static) URL, a remote attacker may exhausts Swift proxy-server resources, potentially resulting in a denial of service.

Affects versions: >=2.2.1 <= 2.3.0, >= 2.4.0 <= 2.5.0

There are two similar bugs, CVE-2016-0738 is for proxy to server connection.

Comment 1 Adam Mariš 2016-01-15 12:12:09 UTC
Created attachment 1115108 [details]
Master/mitaka patch

Comment 2 Adam Mariš 2016-01-15 12:12:39 UTC
Created attachment 1115109 [details]
Stable/kilo patch

Comment 3 Adam Mariš 2016-01-15 12:13:10 UTC
Created attachment 1115112 [details]
Stable/liberty patch

Comment 7 Andrej Nemec 2016-01-21 09:40:16 UTC
Created openstack-swift tracking bugs for this issue:

Affects: fedora-all [bug 1300613]

Comment 8 Andrej Nemec 2016-01-21 09:40:41 UTC
This issue is now public.

Comment 9 Fedora Update System 2016-02-02 19:21:05 UTC
openstack-swift-2.3.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 errata-xmlrpc 2016-02-08 04:35:44 UTC
This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2016:0128 https://rhn.redhat.com/errata/RHSA-2016-0128.html

Comment 11 errata-xmlrpc 2016-02-08 04:36:28 UTC
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2016:0127 https://rhn.redhat.com/errata/RHSA-2016-0127.html

Comment 12 errata-xmlrpc 2016-02-08 04:37:41 UTC
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2016:0126 https://rhn.redhat.com/errata/RHSA-2016-0126.html

Comment 13 errata-xmlrpc 2016-02-09 20:56:48 UTC
This issue has been addressed in the following products:

  OpenStack 7 For RHEL 7

Via RHSA-2016:0155 https://rhn.redhat.com/errata/RHSA-2016-0155.html

Comment 15 errata-xmlrpc 2016-03-01 07:02:21 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6

Via RHSA-2016:0329 https://rhn.redhat.com/errata/RHSA-2016-0329.html

Comment 16 errata-xmlrpc 2016-03-01 07:03:06 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7

Via RHSA-2016:0328 https://rhn.redhat.com/errata/RHSA-2016-0328.html