Bug 1110809 – CVE-2014-3497 openstack-swift: XSS in Swift requests through WWW-Authenticate header

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1110809 - (CVE-2014-3497) CVE-2014-3497 openstack-swift: XSS in Swift requests through WWW-Authenticate header

Summary:	CVE-2014-3497 openstack-swift: XSS in Swift requests through WWW-Authenticate...

Status:	CLOSED ERRATA

Aliases:	CVE-2014-3497

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140619,repor...
Keywords:	Security

Depends On:	1113382 1113381 1113797 1113798
Blocks:	1110812
	Show dependency tree / graph

Reported:	2014-06-18 09:47 EDT by Vasyl Kaigorodov
Modified:	2016-04-27 01:11 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-07-24 14:10:59 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
OpenStack gerrit	101031	None	None	None	Never
Red Hat Product Errata	RHSA-2014:0941	normal	SHIPPED_LIVE	Moderate: openstack-swift security update	2014-07-24 17:21:35 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2014-06-18 09:47:21 EDT

The OpenStack project reports:

Title: XSS in Swift requests through WWW-Authenticate header
Reporter: Globo.com Security Team
Products: Swift
Versions: 1.11.0 to 1.13.1

Description:
Globo.com Security Team reported a vulnerability in Swift's header value
escaping. By tricking a Swift user into clicking a malicious URL, a
remote attacker may inject data in Swift response while still appearing
to come from the Swift server, potentially leading to other client-side
vulnerabilities. All Swift setups are affected.

Comment 1 Vasyl Kaigorodov 2014-06-18 09:56:14 EDT

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges the Globo.com Security Team as the original reporter.

Comment 2 Murray McAllister 2014-06-26 01:07:36 EDT

This issue is public:

http://www.openwall.com/lists/oss-security/2014/06/19/10

Comment 4 Murray McAllister 2014-06-26 01:08:55 EDT

Created openstack-swift tracking bugs for this issue:

Affects: epel-6 [bug 1113381]

Comment 5 Murray McAllister 2014-06-26 01:13:19 EDT

The version of openstack-swift in Fedora should be too old to be affected.

Comment 9 errata-xmlrpc 2014-07-24 13:22:47 EDT

This issue has been addressed in following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:0941 https://rhn.redhat.com/errata/RHSA-2014-0941.html

Comment 10 Martin Prpič 2014-07-28 07:05:54 EDT

IssueDescription:

It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL.

Note You need to log in before you can comment on or make changes to this bug.