RHSA-2023:1277 - Security Advisory

Topic

An update for openstack-swift is now available for Red Hat OpenStack
Platform.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

OpenStack Object Storage (swift) aggregates commodity servers to
work together in clusters for reliable, redundant, and large-scale storage
of static objects. Objects are written to multiple hardware devices in the
data center, with the OpenStack software responsible for ensuring data
replication and integrity across the cluster. Storage clusters can scale
horizontally by adding new nodes, which are automatically configured.
Should a node fail, OpenStack works to replicate its content from other
active nodes. Because OpenStack uses software logic to ensure data
replication and distribution across different devices, inexpensive
commodity hard drives and servers can be used in lieu of more expensive
equipment.

Security Fix(es):

• Arbitrary file access through custom S3 XML entities (CVE-2022-47950)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Solution

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack for IBM Power 16.2 ppc64le
• Red Hat OpenStack for IBM Power 16.1 ppc64le
• Red Hat OpenStack 16.2 x86_64
• Red Hat OpenStack 16.1 x86_64
• Red Hat OpenStack 13 - Extended Life Cycle Support 13 x86_64
• Red Hat OpenStack 13 for IBM Power - Extended Life Cycle Support 13 ppc64le

Fixes

• BZ - 2160618 - CVE-2022-47950 openstack-swift: Arbitrary file access through custom S3 XML entities

CVEs

• CVE-2022-47950

References

• https://access.redhat.com/security/updates/classification/#important