Synopsis

Moderate: openstack-swift security update

Type/Severity

Security Advisory: Moderate

Topic

Updated openstack-swift packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

OpenStack Object Storage (swift) provides object storage in virtual
containers, which allows users to store and retrieve files (arbitrary
data). The service's distributed architecture supports horizontal scaling;
redundancy as failure-proofing is provided through software-based data
replication. Because Object Storage supports asynchronous eventual
consistency replication, it is well suited to multiple data-center
deployment.

A flaw was found in OpenStack Object Storage that could allow an
authenticated user to delete the most recent version of a versioned object
regardless of ownership. To exploit this flaw, an attacker must know the
name of the object and have listing access to the x-versions-location
container. (CVE-2015-1856)

Red Hat would like to thank the OpenStack project for reporting this issue.
Upstream acknowledges Clay Gerrard of SwiftStack as the original reporter.

All users of openstack-swift are advised to upgrade to these updated
packages, which correct this issue. After installing this update, the
OpenStack Object Storage services will be restarted automatically.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 5.0 for RHEL 7 x86_64
• Red Hat OpenStack 5.0 for RHEL 6 x86_64

Fixes

• BZ - 1209994 - CVE-2015-1856 OpenStack Swift: unauthorized deletion of versioned Swift object

CVEs

• CVE-2015-1856

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat OpenStack 5.0 for RHEL 7

SRPM
x86_64
openstack-swift-1.13.1-5.el7ost.noarch.rpm	SHA-256: 206a6a4fd8c2c8a7546d7af32d45d457ffc6a9f111b97fbea143256f24da9f07
openstack-swift-account-1.13.1-5.el7ost.noarch.rpm	SHA-256: 2fd240396a21509be6b2d6be004eee3f3c2ea4683aa7c9f73b6edc5a67367ac8
openstack-swift-container-1.13.1-5.el7ost.noarch.rpm	SHA-256: 39dc1ee955c85e36efc6083730234fa8efd0394df4bf600b8fc2b3d363ee264a
openstack-swift-doc-1.13.1-5.el7ost.noarch.rpm	SHA-256: 08c43986ffcff01f242126bb63c1d75e0523923b90fa2f859dc13c0f61ffa91d
openstack-swift-object-1.13.1-5.el7ost.noarch.rpm	SHA-256: f4970eeb2ce7457fc09c8e7f40f664994306c63e3f726e906e8c0d0d701bf0f4
openstack-swift-proxy-1.13.1-5.el7ost.noarch.rpm	SHA-256: 3fa8c4e304ed97f7d9f549a881f06f08ad1df2557a64f307d4d13b5fa5be7bff

Red Hat OpenStack 5.0 for RHEL 6

SRPM
openstack-swift-1.13.1-6.el6ost.src.rpm	SHA-256: f28376c28aa60efad065a283dcbde0d3ca424734c9632b31fe946fad4464035e
x86_64
openstack-swift-1.13.1-6.el6ost.noarch.rpm	SHA-256: 1cc06e8859696c8fdcc9a2ed5f4468eb70bf093ed75fa466688fddc08ea22e70
openstack-swift-account-1.13.1-6.el6ost.noarch.rpm	SHA-256: 4cae4da4a8b962dcf1602c34718b890e62363f11941c4c3c08339a02004b7ffe
openstack-swift-container-1.13.1-6.el6ost.noarch.rpm	SHA-256: 12601d81bff7dc6c35ece23a5246f1c0f857d650476a24f50bd83690c26c1c5f
openstack-swift-doc-1.13.1-6.el6ost.noarch.rpm	SHA-256: b712c4018726ec2b9a240d60ad1a7e10a6de7f741bd2104119db8e3f94c8fd54
openstack-swift-object-1.13.1-6.el6ost.noarch.rpm	SHA-256: 5ce19b55b4c67407ffb9488efefc940fb249966c8f82845488a614e6d595f638
openstack-swift-proxy-1.13.1-6.el6ost.noarch.rpm	SHA-256: ea34dbe4d03cfa810a4032328b2eea7cccd8c74b70bb17565a82cdc5cf54f5e6