[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 8 Oct 2014 04:52:52 -0400 (EDT)
From: cve-assign@...re.org
To: jeremy@...nstack.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for vulnerability in OpenStack Swift
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Versions: up to 2.1.0
> a vulnerability in Swift enforcement of metadata contraints. By adding
> metadata in several separate calls, an authenticated attacker can
> bypass the max_meta_count constraint, potentially resulting in the
> storage of more metadata than allowed in configuration.
> https://launchpad.net/bugs/1365350
> If we pass more than 90 metadata in one request, it fails. But if we
> pass 50 in one request and 50 in another request, the request is
> successfully processed which is against documentation.
> The above case occurs in account and container only. While in object
> case, the metadata is overwritten with new request's metadata.
Use CVE-2014-7960.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUNPrtAAoJEKllVAevmvmsMCYH/Rh+WJrLAUS9X4WQoP0amenB
1ABykY/srIZTQqTF45CFWV2eN/9XUgqCNA5RvhtsIBDrMsA4kTUax2k3rCNewucX
YaprOeZtmtZz+pkRH1CANN/E152+NKAiYAdZ6hq5fyFprU5VY9L2fosUqW4S2B0u
Klc1mQsE1lSCpFVbvSalgv+xwiGPi439G1QfPIz2Tpq6s33eWnl7YQXSFapGDc7M
Axk/mf0HND8Vpcn9DE/eo06yA7bYNJfA3OKflKwmVIO/CabJ+mNGUYuOts1hF22A
xE5wtAlZAx1I6FmWOgU11Y2dDqK1p/DjlHLwvn+qHEA/acTyMkachc+imR88fX4=
=mGg8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
