CVE-2015-5223 OpenStack Object Storage (Swift) Sensitive Data Exposure
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 2.4.0 | 2.4.0 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 2.4.0-1 | 2.4.0-1 |
| debian/swift(Debian:13) | < 2.4.0-1 | 2.4.0-1 |
| debian/swift(Debian:14) | < 2.4.0-1 | 2.4.0-1 |
| OpenStack Swift | <= 2.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net
- bugs.launchpad.net
- security.openstack.org vendor-advisory
- SUSE-SU-2015:1846 vendor-advisory
- RHSA-2015:1895 vendor-advisory
- RHSA-2016:0329 vendor-advisory
- [oss-security] 20150826 Subject: [OSSA 2015-016] Information leak via Swift tempurls (CVE-2015-5223) mailing-list
- www.oracle.com
- web.archive.org
- github.com vendor-advisory
- github.com product
- pypi.org product
- Debian Security Tracker CVE-2015-5223 vendor-advisory
- 84827 vdb-entry
- bugs.debian.org issue-tracking