Bug 991626 (CVE-2013-4155)

Summary: CVE-2013-4155 OpenStack: Swift Denial of Service using superfluous object tombstones
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, chrisw, dallan, derekh, gkotton, gmollett, markmc, rbryant, sclewis, security-response-team, yeylon, zaitcev
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130807,reported=20130802,source=upstream,cvss2=4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P,fedora-all/openstack-swift=affected,epel-6/openstack-swift=affected,openstack-3/openstack-swift=affected,openstack-4/openstack-swift=affected,openstack-rdo/openstack-swift=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-03-09 21:27:11 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 995299, 991627, 994665, 994666, 994667    
Bug Blocks: 991628    
Attachments:
Description Flags
swift-folsom-CVE-2013-4155.patch
none
swift-grizzly-CVE-2013-4155.patch
none
swift-master-CVE-2013-4155.patch none

Description Kurt Seifried 2013-08-03 00:31:53 EDT
Thierry Carrez (thierry@openstack.org) reports:

Title: Swift Denial of Service using superfluous object tombstones
Reporter: Peter Portante (Red Hat)
Products: Swift
Affects: All versions

Description:
Peter Portante from Red Hat reported a vulnerability in Swift. By
issuing requests with an old X-Timestamp value, an authenticated
attacker can fill an object server with superfluous object tombstones,
which may significantly slow down subsequent requests to that object
server, facilitating a Denial of Service attack against Swift clusters.

Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Swift master (havana), stable/grizzly, and
stable/folsom branches on the public disclosure date. A new Swift
release (1.9.1) will be cut shortly after to include those patches.
Comment 2 Kurt Seifried 2013-08-03 00:34:28 EDT
Created attachment 782214 [details]
swift-folsom-CVE-2013-4155.patch
Comment 3 Kurt Seifried 2013-08-03 00:34:58 EDT
Created attachment 782215 [details]
swift-grizzly-CVE-2013-4155.patch
Comment 4 Kurt Seifried 2013-08-03 00:35:25 EDT
Created attachment 782216 [details]
swift-master-CVE-2013-4155.patch
Comment 7 Fedora Update System 2013-08-18 17:36:27 EDT
openstack-swift-1.8.0-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Murray McAllister 2013-09-02 11:40:43 EDT
Acknowledgements:

This issue was discovered by Peter Portante of Red Hat.
Comment 9 errata-xmlrpc 2013-09-03 16:25:14 EDT
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1197 https://rhn.redhat.com/errata/RHSA-2013-1197.html