CVE-2017-8761: Temporary urls leaked via logging in OpenStack Swift
Summary
CVE-2017-8761: Temporary urls leaked via logging. Affects swift versions < 2.15.2. Fixed in 2.15.2. How to fix ↓
Also tracked for
- swift · Debian:11
The same CVE-2017-8761 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Swift is an open-source object storage system designed to store and retrieve large amounts of unstructured data. It provides a scalable and highly available storage solution for cloud environments. The tempurl middleware in Swift allows users to generate temporary URLs with limited access permissions for sharing objects. However, prior to version 2.15.2, the proxy-server logs full tempurl paths, potentially exposing reusable tempurl signatures to anyone with read access to these logs.
Vulnerability Detail
The vulnerability in OpenStack Swift allows an attacker with read access to the proxy-server logs to obtain reusable tempurl signatures. This can lead to unauthorized access to objects and potential data leakage. The issue arises from the logging of full tempurl paths, which should be treated as sensitive information. The impact of this vulnerability can be significant, as it compromises the security of temporary URLs and undermines the access control mechanisms provided by the tempurl middleware.
How To Fix
Minimum fixed version
2.15.2
This is the first release that contains the fix.
pip install --upgrade "swift==2.15.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to restrict access to the proxy-server logs and ensure that only authorized personnel have read access to these logs. Additionally, monitoring the logs for any suspicious activity can help detect potential misuse of tempurl signatures.
Conclusion
The vulnerability in OpenStack Swift allows for the leakage of reusable tempurl signatures through logging. Upgrading to version 2.15.2 or later is recommended to fix this issue. Restricting access to the proxy-server logs and monitoring them for any unauthorized access can also help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for swift →
FAQ
OpenStack Swift is an open-source object storage system designed for storing and retrieving large amounts of unstructured data. It provides a scalable and highly available storage solution for cloud environments.
The tempurl middleware in OpenStack Swift allows users to generate temporary URLs with limited access permissions for sharing objects. These temporary URLs can be used to provide time-limited access to specific objects without requiring authentication.
The vulnerability allows an attacker with read access to the proxy-server logs to obtain reusable tempurl signatures. This can lead to unauthorized access to objects and potential data leakage.
To fix the vulnerability, it is recommended to upgrade to OpenStack Swift version 2.15.2 or later. This version includes a fix that prevents the logging of full tempurl paths.
There is no specific workaround mentioned for this vulnerability. However, restricting access to the proxy-server logs and monitoring them for any suspicious activity can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for swift.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.