GHSA-cf9m-q836-vf26

OpenStack Swift Discloses Secret URLs to Timing Attack

Source: GitHub Advisory Database (reviewed) High CVE-2014-0006

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	swift	>= 1.4.6, <= 1.8.0	no fix listed
PyPI	swift	>= 1.9.0, <= 1.10.0	no fix listed
PyPI	swift	>= 1.11.0, < 1.12.0	1.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-0006 advisory
https://github.com/openstack/swift/commit/754633988931e4095530f6b13389c254096eb485 web
https://bugs.launchpad.net/swift/+bug/1265665 web
https://github.com/openstack/swift web
https://github.com/pypa/advisory-database/tree/main/vulns/swift/PYSEC-2014-116.yaml web
http://rhn.redhat.com/errata/RHSA-2014-0232.html web
http://www.openwall.com/lists/oss-security/2014/01/17/5 web