UBUNTU-CVE-2014-7960

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the maxmetacount and other metadata constraints via multiple crafted requests which exceed the limit when combined.

References

Affected packages

Ubuntu:14.04:LTS / swift

Package

Name: swift
Purl: pkg:deb/ubuntu/swift@1.13.1-0ubuntu1.2?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.1-0ubuntu1.2

Affected versions

1.*

1.10.0~rc1-0ubuntu1

1.10.0-0ubuntu1

1.11.0-0ubuntu2

1.12.0-0ubuntu1

1.13.0-0ubuntu1

1.13.1~rc1-0ubuntu2

1.13.1~rc2-0ubuntu1

1.13.1-0ubuntu1

1.13.1-0ubuntu1.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "python-swift",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift-account",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift-container",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift-object",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift-object-expirer",
            "binary_version": "1.13.1-0ubuntu1.2"
        },
        {
            "binary_name": "swift-proxy",
            "binary_version": "1.13.1-0ubuntu1.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-7960.json"