UBUNTU-CVE-2022-47950

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2022-47950

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-47950.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-47950

Related

Published

2023-01-18T17:15:00Z

Modified

2024-10-15T14:10:20Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

References

Affected packages

Ubuntu:Pro:16.04:LTS / swift

Package

Name: swift
Purl: pkg:deb/ubuntu/swift?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5.0-0ubuntu1

2.7.0-0ubuntu2

2.7.0-0ubuntu2.1

2.7.1-0ubuntu1

2.7.1-0ubuntu2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / swift

Package

Name: swift
Purl: pkg:deb/ubuntu/swift?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.25.2-0ubuntu1.1

Affected versions

2.*

2.23.0-0ubuntu1

2.23.1-0ubuntu1

2.24.0~git2019121715.e890b0f0f-0ubuntu1

2.24.0-0ubuntu1

2.24.1~git2020032711.712bf3c9f-0ubuntu2

2.24.1~git2020041316.a495f1e32-0ubuntu1

2.25.0-0ubuntu0.20.04.1

2.25.1-0ubuntu1

2.25.2-0ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "python3-swift"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-account"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-container"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-doc"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-object"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-object-expirer"
        },
        {
            "binary_version": "2.25.2-0ubuntu1.1",
            "binary_name": "swift-proxy"
        }
    ]
}

Ubuntu:22.04:LTS / swift

Package

Name: swift
Purl: pkg:deb/ubuntu/swift?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.2-0ubuntu1

Affected versions

2.*

2.28.0+git2021090911.5d52afbe4-0ubuntu1

2.28.0+git2021120815.1859f2e16-0ubuntu1

2.28.0+git2021121320.876377435-0ubuntu1

2.28.0+git2022011309.32da73f5c-0ubuntu1

2.29.0+git2022030314.3ff3076ce-0ubuntu1

2.29.0+git2022030314.3ff3076ce-0ubuntu2

2.29.1-0ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "python3-swift"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-account"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-container"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-doc"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-object"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-object-expirer"
        },
        {
            "binary_version": "2.29.2-0ubuntu1",
            "binary_name": "swift-proxy"
        }
    ]
}