PT-2014-8345 · Openstack+1 · Openstack Object Storage+1

Rajaneesh Singh + 1 · Published 2014-10-17 · Updated 2022-05-17 · CVE-2014-7960

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Object Storage (Swift) versions prior to 2.2.0

Description The issue allows remote authenticated users to bypass certain metadata constraints, such as max meta count, by sending multiple crafted requests that exceed the limit when combined.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-7960

GHSA-G6X3-55QV-X6P2

RHSA-2015:0835

RHSA-2015:0836

RHSA-2015:1495

SUSE-SU-2015:1846-1

USN-2704-1

Affected Products

Openstack Object Storage

Ubuntu

References · 39

• http://ubuntu.com/usn/USN-2704-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1856 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0836.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0835.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7960 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1495.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7960 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7960 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-7960 · Security Note
• https://ubuntu.com/security/CVE-2015-1856 · Vendor Advisory
• https://bugs.launchpad.net/swift/+bug/1365350 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7960 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g6x3-55qv-x6p2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-7960 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html · Vendor Advisory