Security update for openstack-swift

Announcement ID: SUSE-SU-2015:1846-1
Rating: important
References:
Cross-References:
CVSS scores:
Affected Products:
  • SUSE Cloud 5

An update that solves three vulnerabilities can now be installed.

Description:

openstack-swift was updated to fix three security issues.

These security issues were fixed: - CVE-2015-1856: OpenStack Object Storage (Swift), when allow_version is configured, allowed remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container (bsc#927793). - CVE-2014-7960: OpenStack Object Storage (Swift) allowed remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined (bsc#900253). - CVE-2015-5223: Information leak via Swift tempurls (bsc#942641).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Cloud 5
    zypper in -t patch sleclo50sp3-openstack-swift-12171=1

Package List:

  • SUSE Cloud 5 (x86_64)
    • openstack-swift-account-2.1.0-11.1
    • openstack-swift-object-2.1.0-11.1
    • openstack-swift-proxy-2.1.0-11.1
    • openstack-swift-container-2.1.0-11.1
    • openstack-swift-2.1.0-11.1
    • python-swift-2.1.0-11.1
  • SUSE Cloud 5 (noarch)
    • openstack-swift-doc-2.1.0-11.1

References: