CVE-2014-7960 OpenStack Swift metadata constraints are not correctly enforced
MediumCVSS 4.0
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 2.2.0 | 2.2.0 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 2.2.0-1 | 2.2.0-1 |
| debian/swift(Debian:13) | < 2.2.0-1 | 2.2.0-1 |
| debian/swift(Debian:14) | < 2.2.0-1 | 2.2.0-1 |
| OpenStack Swift | <= 2.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net vendor-advisory
- openstack-swift-cve20147960-sec-bypass(96901) vdb-entry
- github.com product
- SUSE-SU-2015:1846 vendor-advisory
- RHSA-2015:0835 vendor-advisory
- RHSA-2015:0836 vendor-advisory
- RHSA-2015:1495 vendor-advisory
- [oss-security] 20141007 CVE request for vulnerability in OpenStack Swift mailing-list
- [oss-security] 20141008 Re: CVE request for vulnerability in OpenStack Swift mailing-list
- www.oracle.com
- 70279 vdb-entry
- USN-2704-1 vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-7960 vendor-advisory