Bug 991626 (CVE-2013-4155) - CVE-2013-4155 OpenStack: Swift Denial of Service using superfluous object tombstones
Summary: CVE-2013-4155 OpenStack: Swift Denial of Service using superfluous object tom...
Alias: CVE-2013-4155
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=moderate,public=20130807,repor...
Depends On: 995299 991627 994665 994666 994667
Blocks: 991628
TreeView+ depends on / blocked
Reported: 2013-08-03 04:31 UTC by Kurt Seifried
Modified: 2019-06-08 19:40 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-03-10 01:27:11 UTC

Attachments (Terms of Use)
swift-folsom-CVE-2013-4155.patch (20.91 KB, patch)
2013-08-03 04:34 UTC, Kurt Seifried
no flags Details | Diff
swift-grizzly-CVE-2013-4155.patch (20.10 KB, patch)
2013-08-03 04:34 UTC, Kurt Seifried
no flags Details | Diff
swift-master-CVE-2013-4155.patch (22.25 KB, patch)
2013-08-03 04:35 UTC, Kurt Seifried
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1197 normal SHIPPED_LIVE Moderate: openstack-swift security update 2013-09-04 00:17:08 UTC

Description Kurt Seifried 2013-08-03 04:31:53 UTC
Thierry Carrez (thierry@openstack.org) reports:

Title: Swift Denial of Service using superfluous object tombstones
Reporter: Peter Portante (Red Hat)
Products: Swift
Affects: All versions

Peter Portante from Red Hat reported a vulnerability in Swift. By
issuing requests with an old X-Timestamp value, an authenticated
attacker can fill an object server with superfluous object tombstones,
which may significantly slow down subsequent requests to that object
server, facilitating a Denial of Service attack against Swift clusters.

Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Swift master (havana), stable/grizzly, and
stable/folsom branches on the public disclosure date. A new Swift
release (1.9.1) will be cut shortly after to include those patches.

Comment 2 Kurt Seifried 2013-08-03 04:34:28 UTC
Created attachment 782214 [details]

Comment 3 Kurt Seifried 2013-08-03 04:34:58 UTC
Created attachment 782215 [details]

Comment 4 Kurt Seifried 2013-08-03 04:35:25 UTC
Created attachment 782216 [details]

Comment 7 Fedora Update System 2013-08-18 21:36:27 UTC
openstack-swift-1.8.0-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Murray McAllister 2013-09-02 15:40:43 UTC

This issue was discovered by Peter Portante of Red Hat.

Comment 9 errata-xmlrpc 2013-09-03 20:25:14 UTC
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1197 https://rhn.redhat.com/errata/RHSA-2013-1197.html

Note You need to log in before you can comment on or make changes to this bug.