Bug 991626 - (CVE-2013-4155) CVE-2013-4155 OpenStack: Swift Denial of Service using superfluous object tombstones
CVE-2013-4155 OpenStack: Swift Denial of Service using superfluous object tom...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20130807,repor...
: Security
Depends On: 995299 991627 994665 994666 994667
Blocks: 991628
  Show dependency treegraph
 
Reported: 2013-08-03 00:31 EDT by Kurt Seifried
Modified: 2016-04-26 20:23 EDT (History)
15 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-03-09 21:27:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
swift-folsom-CVE-2013-4155.patch (20.91 KB, patch)
2013-08-03 00:34 EDT, Kurt Seifried
no flags Details | Diff
swift-grizzly-CVE-2013-4155.patch (20.10 KB, patch)
2013-08-03 00:34 EDT, Kurt Seifried
no flags Details | Diff
swift-master-CVE-2013-4155.patch (22.25 KB, patch)
2013-08-03 00:35 EDT, Kurt Seifried
no flags Details | Diff

  None (edit)
Description Kurt Seifried 2013-08-03 00:31:53 EDT
Thierry Carrez (thierry@openstack.org) reports:

Title: Swift Denial of Service using superfluous object tombstones
Reporter: Peter Portante (Red Hat)
Products: Swift
Affects: All versions

Description:
Peter Portante from Red Hat reported a vulnerability in Swift. By
issuing requests with an old X-Timestamp value, an authenticated
attacker can fill an object server with superfluous object tombstones,
which may significantly slow down subsequent requests to that object
server, facilitating a Denial of Service attack against Swift clusters.

Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Swift master (havana), stable/grizzly, and
stable/folsom branches on the public disclosure date. A new Swift
release (1.9.1) will be cut shortly after to include those patches.
Comment 2 Kurt Seifried 2013-08-03 00:34:28 EDT
Created attachment 782214 [details]
swift-folsom-CVE-2013-4155.patch
Comment 3 Kurt Seifried 2013-08-03 00:34:58 EDT
Created attachment 782215 [details]
swift-grizzly-CVE-2013-4155.patch
Comment 4 Kurt Seifried 2013-08-03 00:35:25 EDT
Created attachment 782216 [details]
swift-master-CVE-2013-4155.patch
Comment 7 Fedora Update System 2013-08-18 17:36:27 EDT
openstack-swift-1.8.0-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Murray McAllister 2013-09-02 11:40:43 EDT
Acknowledgements:

This issue was discovered by Peter Portante of Red Hat.
Comment 9 errata-xmlrpc 2013-09-03 16:25:14 EDT
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1197 https://rhn.redhat.com/errata/RHSA-2013-1197.html

Note You need to log in before you can comment on or make changes to this bug.