PT-2013-4876 · Openstack · Openstack Swift

Peter Portante · Published 2013-08-20 · Updated 2022-05-17 · CVE-2013-4155

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 1.9.1 in Folsom, Grizzly, and Havana

Description The issue allows authenticated users to cause a denial of service, leading to "superfluous" tombstone consumption and a slowdown of the Swift cluster. This can be achieved via a DELETE request with a timestamp that is older than expected.

Recommendations For OpenStack Swift versions prior to 1.9.1 in Folsom, Grizzly, and Havana, update to version 1.9.1 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-4155

DSA-2737-1

GHSA-WXX2-GQVV-34HX

RHSA-2013:1197

Affected Products

Openstack Swift

References · 16

• http://rhn.redhat.com/errata/RHSA-2013-1197.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4155 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4155 · Vendor Advisory
• http://ubuntu.com/usn/USN-2001-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxx2-gqvv-34hx · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4155 · Vendor Advisory
• https://github.com/openstack/swift · Note
• https://github.com/openstack/swift/commit/6b9806e0e8cbec60c0a3ece0bd516e0502827515 · Note
• https://github.com/openstack/swift/commit/1f4ec235cdfd8c868f2d6458532f9dc32c00b8ca · Note
• https://review.openstack.org/#/c/40646 · Note
• http://openwall.com/lists/oss-security/2013/08/07/6 · Note
• https://review.openstack.org/#/c/40643 · Note
• https://review.openstack.org/#/c/40645 · Note