Bug 1298924 (CVE-2016-0737)

Summary: CVE-2016-0737 openstack-swift: Client to proxy DoS through Large Objects
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aavati, abaron, aortega, apevec, ayoung, chrisw, dallan, derekh, gkotton, gmollett, jjoyce, jrusnack, jschluet, kbasil, lhh, lpeer, markmc, mburns, nlevinki, rbryant, rfortier, sclewis, security-response-team, sgirijan, sisharma, slinaber, slong, smohan, srevivo, ssaha, tdecacqu, tshefi, vbellur, yeylon, zaitcev
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A memory-leak issue was found in OpenStack Object Storage (swift), in the client-to-proxy connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-01 10:31:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1299668, 1299669, 1299670, 1299671, 1300607, 1300608, 1308476    
Bug Blocks: 1298929, 1312737    

Description Adam Mariš 2016-01-15 12:20:58 UTC
A DoS vulnerability in openstack-swift was reported. By repeatedly requesting and interrupting connections to a Large Object (Dynamic or Static) URL, a remote attacker may exhausts Swift proxy-server resources, potentially resulting in a denial of service.

Affects versions: >=2.2.1 <= 2.3.0

Upstream patch:

https://review.openstack.org/#/c/217750/

There are similar bugs CVE-2016-0737 and CVE-2016-0738. This (CVE-2016-0737) is for client to proxy connection.

Comment 1 Adam Mariš 2016-01-15 12:26:49 UTC
Acknowledgments:

Red Hat would like to thank Openstack project for reporting this issue.
Upstream acknowledges Romain Le Disez from OVH and Örjan Persson from Kiliaro as the original reporters.

Comment 4 Andrej Nemec 2016-01-21 09:35:14 UTC
Created openstack-swift tracking bugs for this issue:

Affects: fedora-all [bug 1300608]

Comment 5 Andrej Nemec 2016-01-21 09:36:47 UTC
This issue is now public.

Comment 6 errata-xmlrpc 2016-02-08 04:35:56 UTC
This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2016:0128 https://rhn.redhat.com/errata/RHSA-2016-0128.html

Comment 7 errata-xmlrpc 2016-02-08 04:36:41 UTC
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2016:0127 https://rhn.redhat.com/errata/RHSA-2016-0127.html

Comment 8 errata-xmlrpc 2016-02-08 04:37:51 UTC
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2016:0126 https://rhn.redhat.com/errata/RHSA-2016-0126.html

Comment 9 errata-xmlrpc 2016-02-09 20:56:58 UTC
This issue has been addressed in the following products:

  OpenStack 7 For RHEL 7

Via RHSA-2016:0155 https://rhn.redhat.com/errata/RHSA-2016-0155.html

Comment 11 errata-xmlrpc 2016-03-01 07:02:33 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6

Via RHSA-2016:0329 https://rhn.redhat.com/errata/RHSA-2016-0329.html

Comment 12 errata-xmlrpc 2016-03-01 07:03:17 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7

Via RHSA-2016:0328 https://rhn.redhat.com/errata/RHSA-2016-0328.html