Security update for openstack-swift
An update that fixes one vulnerability is now available.
A timing attack vulnerability has been fixed in
openstack-swift, namely in the Swift TempURL middleware.
By analyzing response times to arbitrary TempURL requests,
an attacker may be able to guess valid secret URLs and get
access to objects that were only intended to be publicly
shared with specific recipients. In order to use this
attack, the attacker needs to know the targeted object
name, and the object account needs to have a TempURL key
set. Only Swift setups enabling the TempURL middleware are
Security Issue reference:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Cloud 3:
zypper in -t patch sleclo30sp3-openstack-swift-8959
To bring your system up-to-date, use "zypper patch".
- SUSE Cloud 3 (x86_64):
- SUSE Cloud 3 (noarch):