PT-2013-3571 · Openstack · Openstack Swift

Alex Gaynor · Published 2013-08-20 · Updated 2022-05-14 · CVE-2013-2161

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions Folsom through Havana

Description The issue allows attackers to trigger invalid or spoofed responses via an account name, potentially exploiting an XML injection vulnerability in the account/utils.py file.

Recommendations For OpenStack Swift versions Folsom through Havana, update to a version that includes a fix for this issue to prevent XML injection attacks.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-2161

DSA-2737-1

GHSA-9XGV-6V35-MMCJ

RHSA-2013:0993

Affected Products

Openstack Swift

References · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2161 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2161 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0993.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2161 · Security Note
• http://debian.org/security/2012/dsa-2737 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9xgv-6v35-mmcj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2161 · Vendor Advisory
• https://github.com/openstack/swift/commit/6659382c4fa348e1ebbce2424968dd7267ea1db1 · Note
• https://github.com/openstack/swift/commit/8f9b135e0a16478a628f20224ce5babe62d4aaba · Note
• https://github.com/openstack/swift · Note
• http://openwall.com/lists/oss-security/2013/06/13/4 · Note
• https://bugs.launchpad.net/swift/+bug/1183884 · Note
• http://github.com/openstack/swift/commit/92d7eadd328797d392758c79e258c8455874c80e · Note
• http://github.com/openstack/swift/commit/4eed6bf5b5028409f730be97ddcfb6bfa893c976 · Note