Bug 1209994 (CVE-2015-1856) - CVE-2015-1856 OpenStack Swift: unauthorized deletion of versioned Swift object
Summary: CVE-2015-1856 OpenStack Swift: unauthorized deletion of versioned Swift object
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-1856
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1246357 1246358 1246360 1248348 1248349
Blocks: 1209996
TreeView+ depends on / blocked
 
Reported: 2015-04-08 15:41 UTC by Vasyl Kaigorodov
Modified: 2023-05-12 08:01 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in OpenStack Object Storage that could allow an authenticated user to delete the most recent version of a versioned object regardless of ownership. To exploit this flaw, an attacker must know the name of the object and have listing access to the x-versions-location container.
Clone Of:
Environment:
Last Closed: 2017-03-23 06:47:10 UTC
Embargoed:

Attachments (Terms of Use)
cve-2015-1856-master-kilo.patch (10.84 KB, text/plain)
2015-04-10 10:19 UTC, Vasyl Kaigorodov 		no flags Details
cve-2015-1856-stable-icehouse.patch (8.73 KB, text/plain)
2015-04-10 10:19 UTC, Vasyl Kaigorodov 		no flags Details
cve-2015-1856-stable-juno.patch (10.82 KB, text/plain)
2015-04-10 10:19 UTC, Vasyl Kaigorodov 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1681 0 normal SHIPPED_LIVE Moderate: openstack-swift security update 2015-08-25 02:38:12 UTC
Red Hat Product Errata RHSA-2015:1684 0 normal SHIPPED_LIVE Moderate: openstack-swift security update 2015-08-25 09:58:20 UTC

Description Vasyl Kaigorodov 2015-04-08 15:41:52 UTC 
Upstream reported the below vulnerability in OpenStack:
"""
Title: Unauthorized delete of versioned Swift object
Reporter: Clay Gerrard (SwiftStack)
Products: Swift
Affects: up to version 2.2.2

Description:
Clay Gerrard from SwiftStack reported a vulnerability in Swift object
versioning. An authenticated user can delete the most recent version of
any versioned object who's name is known if the user have listing access
to the x-versions-location container. Only Swift setups with
allow_version setting are affected.
"""

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Clay Gerrard of SwiftStack as the original reporter.
Comment 1 Vasyl Kaigorodov 2015-04-10 10:19:04 UTC 
Created attachment 1013074 [details]
cve-2015-1856-master-kilo.patch
Comment 2 Vasyl Kaigorodov 2015-04-10 10:19:08 UTC 
Created attachment 1013075 [details]
cve-2015-1856-stable-icehouse.patch
Comment 3 Vasyl Kaigorodov 2015-04-10 10:19:12 UTC 
Created attachment 1013076 [details]
cve-2015-1856-stable-juno.patch
Comment 5 Garth Mollett 2015-07-24 05:50:17 UTC 
Created openstack-swift tracking bugs for this issue:

Affects: fedora-all [bug 1246358]
Affects: openstack-rdo [bug 1246360]
Comment 7 errata-xmlrpc 2015-08-24 22:38:30 UTC 
This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2015:1681 https://rhn.redhat.com/errata/RHSA-2015-1681.html
Comment 8 errata-xmlrpc 2015-08-25 05:58:34 UTC 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6
  OpenStack 5 for RHEL 7

Via RHSA-2015:1684 https://rhn.redhat.com/errata/RHSA-2015-1684.html
Comment 9 Siddharth Sharma 2017-03-23 06:46:36 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2015:1845 https://rhn.redhat.com/errata/RHSA-2015-1845.html
Comment 10 Siddharth Sharma 2017-03-23 06:47:10 UTC 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2015:1846 https://rhn.redhat.com/errata/RHSA-2015-1846.html
Note You need to log in before you can comment on or make changes to this bug.