CVE-2015-1856 OpenStack Swift Unauthorized delete of versioned Swift object
MediumCVSS 5.5
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 2.3.0 | 2.3.0 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 2.2.0-2 | 2.2.0-2 |
| debian/swift(Debian:13) | < 2.2.0-2 | 2.2.0-2 |
| debian/swift(Debian:14) | < 2.2.0-2 | 2.2.0-2 |
| OpenStack Swift | <= 2.2.2 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net vendor-advisory
- git.openstack.org
- git.openstack.org
- git.openstack.org
- git.openstack.org
- github.com product
- FEDORA-2015-12245 vendor-advisory
- [openstack-announce] 20150414 [OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856) mailing-list vendor-advisory
- SUSE-SU-2015:1846 vendor-advisory
- RHSA-2015:1681 vendor-advisory
- RHSA-2015:1684 vendor-advisory
- RHSA-2015:1845 vendor-advisory
- RHSA-2015:1846 vendor-advisory
- www.oracle.com
- 74182 third-party-advisory vdb-entry
- USN-2704-1 third-party-advisory vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-1856 vendor-advisory
- bugs.debian.org issue-tracking