[OSSA-2023-001] Swift: Arbitrary file access through custom S3 XML entities (CVE-2022-47950)

Jeremy Stanley fungi at yuggoth.org
Tue Jan 17 15:48:45 UTC 2023


===================================================================
OSSA-2023-001: Arbitrary file access through custom S3 XML entities
===================================================================

:Date: January 17, 2023
:CVE: CVE-2022-47950


Affects
~~~~~~~
- Swift: <2.28.1, >=2.29.0 <2.29.2, ==2.30.0


Description
~~~~~~~~~~~
Sébastien Meriot (OVH) reported a vulnerability in Swift's S3 XML
parser. By supplying specially crafted XML files an authenticated user
may coerce the S3 API into returning arbitrary file contents from the
host server resulting in unauthorized read access to potentially
sensitive data; this impacts both s3api deployments (Rocky or later),
and swift3 deployments (Queens and earlier, no longer actively
developed). Only deployments with S3 compatibility enabled are
affected.


Patches
~~~~~~~
- https://review.opendev.org/870823 (2023.1/antelope)
- https://review.opendev.org/870828 (Wallaby)
- https://review.opendev.org/870827 (Xena)
- https://review.opendev.org/870826 (Yoga)
- https://review.opendev.org/870825 (Zed)


Credits
~~~~~~~
- Sébastien Meriot from OVH (CVE-2022-47950)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1998625
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47950


Notes
~~~~~
- The stable/wallaby branch is under extended maintenance and will receive no
  new point releases, but a patch for it is provided as a courtesy.

-- 
Jeremy Stanley
OpenStack Vulnerability Management Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <https://lists.openstack.org/pipermail/openstack-discuss/attachments/20230117/9f99708f/attachment.sig>


More information about the openstack-discuss mailing list