UBUNTU-CVE-2017-16613

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2017-16613
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-16613.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2017-16613
Related
Published
2017-11-21T13:29:00Z
Modified
2025-01-13T10:21:28Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.

References

Affected packages

Ubuntu:Pro:16.04:LTS / swauth

Package

Name
swauth
Purl
pkg:deb/ubuntu/swauth@1.0.4-0ubuntu1.16.04.1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.4-0ubuntu1
1.0.4-0ubuntu1.16.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / swauth

Package

Name
swauth
Purl
pkg:deb/ubuntu/swauth@1.3.0-1ubuntu1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.0-1ubuntu1

Affected versions

1.*

1.2.0-3
1.2.0-4
1.3.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.3.0-1ubuntu1",
            "binary_name": "python-swauth"
        },
        {
            "binary_version": "1.3.0-1ubuntu1",
            "binary_name": "swauth"
        },
        {
            "binary_version": "1.3.0-1ubuntu1",
            "binary_name": "swauth-doc"
        }
    ]
}