GitHub Advisoryadvisory · PyPI

GHSA-8fxc-qm65-vpxg Temporary urls leaked via logging

LOW Published 2021-06-08 Modified 2021-06-03 Official page ↗
Aliases
CVE-2017-8761
Ecosystem
PyPI
Packages
swift
Severity
Low
Weaknesses
CWE-117, CWE-200
Reviewed
2021-06-03

Affected packages

• PyPI swift: < 2.15.2 → fixed in 2.15.2

Description

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.

Related

Alias · CVE (1)

  • CVE-2017-8761 In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking… vulnerability

Weakness · CWE (2)

  • CWE-117 Improper Output Neutralization for Logs weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References