CVE-2013-4155 OpenStack Swift allows authenticated users to cause a denial of service
MediumCVSS 4.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 1.9.1 | 1.9.1 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 1.8.0-7 | 1.8.0-7 |
| debian/swift(Debian:13) | < 1.8.0-7 | 1.8.0-7 |
| debian/swift(Debian:14) | < 1.8.0-7 | 1.8.0-7 |
| OpenStack folsom | All versions | No fix listed |
| OpenStack grizzly | All versions | No fix listed |
| OpenStack havana | All versions | No fix listed |
| OpenStack Swift | <= 1.9.0 | No fix listed |
| OpenStack Swift | = 1.0.0 | No fix listed |
| OpenStack Swift | = 1.0.1 | No fix listed |
| OpenStack Swift | = 1.0.2 | No fix listed |
| OpenStack Swift | = 1.1.0 | No fix listed |
| OpenStack Swift | = 1.1.0-rc1 | No fix listed |
| OpenStack Swift | = 1.1.0-rc2 | No fix listed |
| OpenStack Swift | = 1.2.0 | No fix listed |
| OpenStack Swift | = 1.2.0-gamma1 | No fix listed |
| OpenStack Swift | = 1.2.0-rc1 | No fix listed |
| OpenStack Swift | = 1.3.0 | No fix listed |
| OpenStack Swift | = 1.3.0-gamma1 | No fix listed |
| OpenStack Swift | = 1.3.0-rc1 | No fix listed |
| OpenStack Swift | = 1.4.0 | No fix listed |
| OpenStack Swift | = 1.4.1 | No fix listed |
| OpenStack Swift | = 1.4.2 | No fix listed |
| OpenStack Swift | = 1.4.3 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack Swift | = 1.4.4 | No fix listed |
| OpenStack Swift | = 1.4.5 | No fix listed |
| OpenStack Swift | = 1.4.6 | No fix listed |
| OpenStack Swift | = 1.4.7 | No fix listed |
| OpenStack Swift | = 1.4.8 | No fix listed |
| OpenStack Swift | = 1.5.0 | No fix listed |
| OpenStack Swift | = 1.6.0 | No fix listed |
| OpenStack Swift | = 1.7.0 | No fix listed |
| OpenStack Swift | = 1.7.2 | No fix listed |
| OpenStack Swift | = 1.7.4 | No fix listed |
| OpenStack Swift | = 1.7.5 | No fix listed |
| OpenStack Swift | = 1.7.6 | No fix listed |
| OpenStack Swift | = 1.8.0 | No fix listed |
| OpenStack Swift | = 1.8.0-rc1 | No fix listed |
| OpenStack Swift | = 1.8.0-rc2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugs.launchpad.net
- github.com product
- review.openstack.org
- RHSA-2013:1197 vendor-advisory
- DSA-2737 vendor-advisory
- [oss-security] 20130807 [OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155) mailing-list
- USN-2001-1 vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-4155 vendor-advisory
- bugs.debian.org issue-tracking