| Package | Affected versions | Patched versions |
|---|---|---|
| swift | ≥ 2.36.0, ≤ 2.36.1≥ 2.37.0, ≤ 2.37.1 | |
| swift | ≥ 2.35.1, < 2.35.3≥ 2.36.0, < 2.36.2≥ 2.37.0, < 2.37.2 | 2.35.32.36.22.37.2 |
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free