GitHub Advisoryadvisory · PyPI

GHSA-cf9m-q836-vf26 OpenStack Swift Discloses Secret URLs to Timing Attack

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2014-0006
Ecosystem
PyPI
Packages
swift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-16

Affected packages

• PyPI swift: >= 1.4.6, <= 1.8.0 (no fix yet) • PyPI swift: >= 1.9.0, <= 1.10.0 (no fix yet) • PyPI swift: >= 1.11.0, < 1.12.0 → fixed in 1.12.0

Description

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Related

Alias · CVE (1)

  • CVE-2014-0006 The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References