Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Red Hat OpenStack 5.0 RHSA-2014:0941-01 Moderate: Swift XSS Risk

red hat
Calendar Grey July 24, 2014
Scroller Redhat
Red Hat has released a vital security patch for openstack-swift, significantly reducing cross-site scripting (XSS) risks in Object Storage for OpenStack users
Updated openstack-swift packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for Red Hat Enterprise Linux 7

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Summary

OpenStack Object Storage (Swift) provides object storage in virtual containers, which allows users to store and retrieve files (arbitrary data).
It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL. (CVE-2014-3497)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges the Globo.com Security Team as the original reporter.
All users of openstack-swift are advised to upgrade to these updated packages, which correct this issue. After installing this update, the OpenStack Object Storage services will be restarted automatically.

Topics%20covered

Topics Covered

security advisory moderate Red Hat cross-site scripting security fix openstack-swift object storage

References

https://access.redhat.com/security/cve/CVE-2014-3497 https://access.redhat.com/security/updates/classification#moderate

Package List

OpenStack 5.0 for RHEL 7:
Source: openstack-swift-1.13.1-3.el7ost.src.rpm python-swiftclient-2.1.0-2.el7ost.src.rpm
noarch: openstack-swift-1.13.1-3.el7ost.noarch.rpm openstack-swift-account-1.13.1-3.el7ost.noarch.rpm openstack-swift-container-1.13.1-3.el7ost.noarch.rpm openstack-swift-doc-1.13.1-3.el7ost.noarch.rpm openstack-swift-object-1.13.1-3.el7ost.noarch.rpm openstack-swift-proxy-1.13.1-3.el7ost.noarch.rpm python-swiftclient-2.1.0-2.el7ost.noarch.rpm python-swiftclient-doc-2.1.0-2.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package


Advisory ID: RHSA-2014:0941-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2014:0941.html
Issue date: 2014-07-24

Topic

Updated openstack-swift packages that fix one security issue are nowavailable for Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse)for Red Hat Enterprise Linux 7.The Red Hat Security Response Team has rated this update as having Moderatesecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat cross-site scripting security fix openstack-swift object storage

Relevant Releases Architectures

OpenStack 5.0 for RHEL 7 - noarch

Bugs Fixed

1110809 - CVE-2014-3497 openstack-swift: XSS in Swift requests through WWW-Authenticate header

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.