CVE-2015-1856

Related Files

Red Hat Security Advisory 2015-1684-01

Posted Aug 26, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1684-01 - OpenStack Object Storage provides object storage in virtual containers, which allows users to store and retrieve files. The service's distributed architecture supports horizontal scaling; redundancy as failure-proofing is provided through software-based data replication. Because Object Storage supports asynchronous eventual consistency replication, it is well suited to multiple data-center deployment. A flaw was found in OpenStack Object Storage that could allow an authenticated user to delete the most recent version of a versioned object regardless of ownership. To exploit this flaw, an attacker must know the name of the object and have listing access to the x-versions-location container.

tags | advisory

systems | linux, redhat

advisories | CVE-2015-1856

SHA-256 | ee39183a3ea994aeff17098083ebe2a8492a6ee3bf022511868c02167de39768

Download | Favorite | View

Red Hat Security Advisory 2015-1681-01

Posted Aug 25, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1681-01 - OpenStack Object Storage provides object storage in virtual containers, which allows users to store and retrieve files. The service's distributed architecture supports horizontal scaling; redundancy as failure-proofing is provided through software-based data replication. Because Object Storage supports asynchronous eventual consistency replication, it is well suited to multiple data-center deployment. A flaw was found in openstack-swift where an authenticated user may delete the most recent version of a versioned object regardless of ownership. To exploit this flaw an attacker most know the name of the object and have listing access to the x-versions-location container.

tags | advisory

systems | linux, redhat

advisories | CVE-2015-1856

SHA-256 | b4620e51dac253858c6c6dd8a14325faa2787471f9702c33b9acaf4a45839e74

Download | Favorite | View

Ubuntu Security Notice USN-2704-1

Posted Aug 6, 2015

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2704-1 - Rajaneesh Singh discovered Swift does not properly enforce metadata limits. An attacker could abuse this issue to store more metadata than allowed by policy. Clay Gerrard discovered Swift allowed users to delete the latest version of object regardless of object permissions when allow_version is configured. An attacker could use this issue to delete objects. Various other issues were also addressed.

tags | advisory

systems | linux, ubuntu

advisories | CVE-2014-7960, CVE-2015-1856

SHA-256 | 8db03feeaa7eb981bf4b8d968079bfd997f069ce59de6319218290165007e54c

Download | Favorite | View