CVE-2017-16613

Source
https://nvd.nist.gov/vuln/detail/CVE-2017-16613
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-16613.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-16613
Aliases
Related
Published
2017-11-21T13:29:00Z
Modified
2025-01-08T10:11:26.060888Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.

References

Affected packages

Git / github.com/openstack-archive/swauth

Affected ranges

Type
GIT
Repo
https://github.com/openstack-archive/swauth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Type
GIT
Repo
https://github.com/openstack/swauth
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Type
GIT
Repo
https://github.com/openstack/swift
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Last affected

Affected versions

1.*

1.0.0
1.0.0-1
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.8
1.1.0
1.10.0
1.10.0.rc1
1.11.0
1.12.0
1.13.0
1.13.1
1.13.1.rc1
1.13.1.rc2
1.2.0
1.3.0
1.3gamma1
1.3rc1
1.4.0
1.4.1
1.4.2
1.4.5
1.4.6
1.8.0.rc1
1.9.2

2.*

2.0.0
2.0.0.rc1
2.0.0.rc2
2.1.0
2.1.0.rc1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.15.1
2.2.0
2.2.0.rc1
2.2.1
2.2.1.rc1
2.2.1c1
2.2.2
2.2.2rc1
2.3.0
2.3.0rc1
2.3.0rc2
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0

upstream-1.*

upstream-1.0.0