CVE-2016-0738 OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
HighCVSS 7.5
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 2.3.1 | 2.3.1 |
| pypi swift(PyPI) | >= 2.4.0, < 2.5.1 | 2.5.1 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 2.5.0-3 | 2.5.0-3 |
| debian/swift(Debian:13) | < 2.5.0-3 | 2.5.0-3 |
| debian/swift(Debian:14) | < 2.5.0-3 | 2.5.0-3 |
| OpenStack Swift | <= 2.3.0 | No fix listed |
| OpenStack Swift | = 2.4.0 | No fix listed |
| OpenStack Swift | = 2.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net vendor-advisory
- github.com vendor-advisory
- security.openstack.org patch vendor-advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- web.archive.org
- lists.fedoraproject.org
- rhn.redhat.com
- rhn.redhat.com
- rhn.redhat.com
- github.com vendor-advisory
- github.com product
- pypi.org product
- Debian Security Tracker CVE-2016-0738 vendor-advisory
- FEDORA-2016-2256c80a94 vendor-advisory
- RHSA-2016:0128 vendor-advisory
- RHSA-2016:0155 vendor-advisory
- RHSA-2016:0329 vendor-advisory
- www.oracle.com
- 81432 vdb-entry
- bugs.debian.org issue-tracking