csaf_redhat - rhsa-2023

rhsa-2023_1013

Vulnerability from csaf_redhat

Published

2023-02-28 15:48

Modified

2024-11-15 13:25

Summary

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-swift) security update

Notes

Topic

An update for openstack-swift is now available for Red Hat OpenStack Platform 17.0 (Wallaby). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

OpenStack Object Storage (swift) aggregates commodity servers to work together in clusters for reliable, redundant, and large-scale storage of static objects. Objects are written to multiple hardware devices in the data center, with the OpenStack software responsible for ensuring data replication and integrity across the cluster. Storage clusters can scale horizontally by adding new nodes, which are automatically configured. Should a node fail, OpenStack works to replicate its content from other active nodes. Because OpenStack uses software logic to ensure data replication and distribution across different devices, inexpensive commodity hard drives and servers can be used in lieu of more expensive equipment. Security Fix(es): * Arbitrary file access through custom S3 XML entities (CVE-2022-47950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-swift is now available for Red Hat OpenStack\nPlatform 17.0 (Wallaby).\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack Object Storage (swift) aggregates commodity servers to\n work together in clusters for reliable, redundant, and large-scale storage\nof static objects. Objects are written to multiple hardware devices in the\ndata center, with the OpenStack software responsible for ensuring data\nreplication and integrity across the cluster. Storage clusters can scale\nhorizontally by adding new nodes, which are automatically configured.\nShould a node fail, OpenStack works to replicate its content from other\nactive nodes. Because OpenStack uses software logic to ensure data\nreplication and distribution across different devices, inexpensive\ncommodity hard drives and servers can be used in lieu of more expensive\nequipment.\n\nSecurity Fix(es):\n\n* Arbitrary file access through custom S3 XML entities (CVE-2022-47950)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:1013",
        "url": "https://access.redhat.com/errata/RHSA-2023:1013"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2160618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160618"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1013.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-swift) security update",
    "tracking": {
      "current_release_date": "2024-11-15T13:25:42+00:00",
      "generator": {
        "date": "2024-11-15T13:25:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:1013",
      "initial_release_date": "2023-02-28T15:48:41+00:00",
      "revision_history": [
        {
          "date": "2023-02-28T15:48:41+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-02-28T15:48:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T13:25:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 17.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 17.0",
                  "product_id": "9Base-RHOS-17.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:17.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
                "product": {
                  "name": "openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
                  "product_id": "openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-swift@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                "product": {
                  "name": "openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_id": "openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-swift-account@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                "product": {
                  "name": "openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_id": "openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-swift-container@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                "product": {
                  "name": "openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_id": "openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-swift-object@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                "product": {
                  "name": "openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_id": "openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-swift-proxy@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                "product": {
                  "name": "python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_id": "python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-swift@2.27.1-0.20230201120900.6a1a8ce.el9ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src"
        },
        "product_reference": "openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        },
        "product_reference": "openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        },
        "product_reference": "openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        },
        "product_reference": "openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        },
        "product_reference": "openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
          "product_id": "9Base-RHOS-17.0:python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        },
        "product_reference": "python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
        "relates_to_product_reference": "9Base-RHOS-17.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "S\u00e9bastien Meriot"
          ],
          "organization": "OVH"
        }
      ],
      "cve": "CVE-2022-47950",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2023-01-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2160618"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Swift\u0027s S3 XML parser. By supplying specially crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This issue impacts both s3api deployments (Rocky or later) and swift3 deployments (Queens and earlier, no longer actively developed). Only deployments with S3 compatibility enabled are affected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-swift: Arbitrary file access through custom S3 XML entities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOS-17.0:openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
          "9Base-RHOS-17.0:openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
          "9Base-RHOS-17.0:openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
          "9Base-RHOS-17.0:openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
          "9Base-RHOS-17.0:openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
          "9Base-RHOS-17.0:python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-47950"
        },
        {
          "category": "external",
          "summary": "RHBZ#2160618",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160618"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-47950",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47950"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-47950",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47950"
        },
        {
          "category": "external",
          "summary": "https://launchpad.net/bugs/1998625",
          "url": "https://launchpad.net/bugs/1998625"
        }
      ],
      "release_date": "2023-01-17T15:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-28T15:48:41+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-RHOS-17.0:openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
            "9Base-RHOS-17.0:openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOS-17.0:openstack-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.src",
            "9Base-RHOS-17.0:openstack-swift-account-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-container-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-object-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:openstack-swift-proxy-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch",
            "9Base-RHOS-17.0:python3-swift-0:2.27.1-0.20230201120900.6a1a8ce.el9ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openstack-swift: Arbitrary file access through custom S3 XML entities"
    }
  ]
}

cve-2022-47950

Vulnerability from cvelistv5

Published

2023-01-18 00:00

Modified

2024-08-03 15:02

Severity ?

Summary

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

References

▼	URL	Tags
	https://launchpad.net/bugs/1998625
	https://security.openstack.org/ossa/OSSA-2023-001.html
	https://lists.debian.org/debian-lts-announce/2023/01/msg00021.html	mailing-list
	https://www.debian.org/security/2023/dsa-5327	vendor-advisory

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:02:36.630Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://launchpad.net/bugs/1998625"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.openstack.org/ossa/OSSA-2023-001.html"
          },
          {
            "name": "[debian-lts-announce] 20230125 [SECURITY] [DLA 3281-1] swift security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00021.html"
          },
          {
            "name": "DSA-5327",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5327"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-25T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://launchpad.net/bugs/1998625"
        },
        {
          "url": "https://security.openstack.org/ossa/OSSA-2023-001.html"
        },
        {
          "name": "[debian-lts-announce] 20230125 [SECURITY] [DLA 3281-1] swift security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00021.html"
        },
        {
          "name": "DSA-5327",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5327"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-47950",
    "datePublished": "2023-01-18T00:00:00",
    "dateReserved": "2022-12-24T00:00:00",
    "dateUpdated": "2024-08-03T15:02:36.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted