CVE-2017-8761 Temporary urls leaked via logging
MediumCVSS 4.3
EPSS 0.82%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | < 2.15.2 | 2.15.2 |
| pypi swift(PyPI) | = 1.0.2 | No fix listed |
| debian/swift(Debian:12) | < 2.17.0-2 | 2.17.0-2 |
| debian/swift(Debian:13) | < 2.17.0-2 | 2.17.0-2 |
| debian/swift(Debian:14) | < 2.17.0-2 | 2.17.0-2 |
| OpenStack Swift | <= 2.10.1 | No fix listed |
| OpenStack Swift | >= 2.11.0, <= 2.13.0 | No fix listed |
| OpenStack Swift | = 2.14.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- launchpad.net issue-tracking third-party-advisory
- bugs.launchpad.net
- github.com vendor-advisory
- pypi.org product
- Debian Security Tracker CVE-2017-8761 vendor-advisory