Bugzilla – Bug 1207035
VUL-0: CVE-2022-47950: openstack-swift: Arbitrary file access through custom S3 XML entities
Last modified: 2024-05-03 09:36:27 UTC
Affected: - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update
Public in oss-sec: =================================================================== OSSA-2023-001: Arbitrary file access through custom S3 XML entities =================================================================== :Date: January 17, 2023 :CVE: CVE-2022-47950 Affects ~~~~~~~ - Swift: <2.28.1, >=2.29.0 <2.29.2, ==2.30.0 Description ~~~~~~~~~~~ Sébastien Meriot (OVH) reported a vulnerability in Swift's S3 XML parser. By supplying specially crafted XML files an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server resulting in unauthorized read access to potentially sensitive data; this impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed). Only deployments with S3 compatibility enabled are affected. Patches ~~~~~~~ - https://review.opendev.org/870823 (2023.1/antelope) - https://review.opendev.org/870828 (Wallaby) - https://review.opendev.org/870827 (Xena) - https://review.opendev.org/870826 (Yoga) - https://review.opendev.org/870825 (Zed) Credits ~~~~~~~ - Sébastien Meriot from OVH (CVE-2022-47950) References ~~~~~~~~~~ - https://launchpad.net/bugs/1998625 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47950 Notes ~~~~~ - The stable/wallaby branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley OpenStack Vulnerability Management Team
SR for Rocky is in review https://build.opensuse.org/request/show/1059354
SUSE-SU-2023:0323-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1207035 CVE References: CVE-2022-47950 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): python-swift3-1.7.0.dev372-3.3.1 SUSE OpenStack Cloud 8 (src): python-swift3-1.7.0.dev372-3.3.1 HPE Helion Openstack 8 (src): python-swift3-1.7.0.dev372-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
(In reply to Darragh O'Reilly from comment #11) > SR for Rocky is in review https://build.opensuse.org/request/show/1059354 This is not needed because it was backported upstream. https://bugs.launchpad.net/swift/+bug/1998625/comments/53
SUSE-SU-2023:2378-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1207035, 1208283, 1209774 CVE References: CVE-2022-47950, CVE-2023-1625, CVE-2023-25577 Sources used: SUSE OpenStack Cloud 9 (src): python-Werkzeug-0.14.1-3.6.2, venv-openstack-heat-11.0.4~dev4-3.43.2, venv-openstack-sahara-9.0.2~dev15-3.41.2, venv-openstack-swift-2.19.3~dev3-2.36.3, venv-openstack-designate-7.0.2~dev2-3.41.2, venv-openstack-magnum-7.2.1~dev1-4.41.3, openstack-swift-2.19.3~dev3-3.6.3, venv-openstack-keystone-14.2.1~dev9-3.42.2, venv-openstack-octavia-3.2.3~dev7-4.41.2, openstack-heat-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9 (src): openstack-swift-2.19.3~dev3-3.6.3, python-Werkzeug-0.14.1-3.6.2, openstack-heat-11.0.4~dev4-3.24.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done, closing