Executive Summary
| Summary | |
|---|---|
| Title | openstack-swift security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2014:0941 | First vendor Publication | 2014-07-24 |
| Vendor | RedHat | Last vendor Modification | 2014-07-24 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated openstack-swift packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: OpenStack 5.0 for RHEL 7 - noarch 3. Description: OpenStack Object Storage (Swift) provides object storage in virtual containers, which allows users to store and retrieve files (arbitrary data). It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL. (CVE-2014-3497) Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges the Globo.com Security Team as the original reporter. All users of openstack-swift are advised to upgrade to these updated packages, which correct this issue. After installing this update, the OpenStack Object Storage services will be restarted automatically. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1110809 - CVE-2014-3497 openstack-swift: XSS in Swift requests through WWW-Authenticate header |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2014-0941.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:25109 | |||
| Oval ID: | oval:org.mitre.oval:def:25109 | ||
| Title: | USN-2256-1 -- swift vulnerability | ||
| Description: | Swift did not properly perform input validation of certain HTTP headers. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2256-1 CVE-2014-3497 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 | Product(s): | swift |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 6 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2256-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-07-24 21:22:54 |
|
