PT-2016-3904 · Apple · Swift3

Darryl Tam + 1 · Publicado 2016-01-13 · Atualizado 2016-12-01 · CVE-2015-8466

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Swift3 versions prior to 1.9

Description The issue allows remote attackers to conduct replay attacks. This is possible via an Authorization request that lacks a Date header.

Recommendations For versions prior to 1.9, update to version 1.9 or later to resolve the issue. As a temporary workaround, consider ensuring all Authorization requests include a Date header to prevent replay attacks.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-8466

DSA-3583-1

Produtos afetados

Swift3

Referências · 10

• https://github.com/openstack/swift3/blob/master/CHANGELOG · Correção
• http://debian.org/security/2016/dsa-3583 · Aviso do Fabricante
• https://bugs.launchpad.net/swift3/+bug/1497424 · Nota
• https://osv.dev/vulnerability/DSA-3583-1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174374.html · Aviso do Fabricante, Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8466 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8466 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-8466 · Nota de Segurança
• https://swiftstack.com/docs/admin/release.html · Nota
• https://ubuntu.com/security/CVE-2015-8466 · Aviso do Fabricante