| Summary: | <sys-cluster/swift-{1.10.0-r1,1.11.0-r1} : TempURL timing attack (CVE-2014-0006) [OSSA 2014-002] | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | trivial | CC: | openstack |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2014/01/17/5 | ||
| Whiteboard: | ~4 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
fixed and removed the badness (fixed in 1.10.0-r1 and 1.11.0-r1) thanks, closing as noglsa. CVE-2014-0006 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0006): The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack. |
From ${URL} : OpenStack Security Advisory: 2014-002 CVE: CVE-2014-0006 Date: January 16, 2013 Title: Swift TempURL timing attack Reporter: Samuel Merritt (SwiftStack) Products: Swift Affects: All supported versions Description: Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to objects that were only intended to be publicly shared with specific recipients. In order to use this attack, the attacker needs to know the targeted object name, and the object account needs to have a TempURL key set. Only Swift setups enabling the TempURL middleware are affected. Icehouse (development branch) fix: https://review.openstack.org/#/c/67185/ Havana (1.10.0) fix: https://review.openstack.org/#/c/67186/ Grizzly (1.8.0) fix: https://review.openstack.org/#/c/67187/ Note: the Icehouse fix will be included in upcoming 1.12.0 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006 https://bugs.launchpad.net/swift/+bug/1265665 @maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.