CVE-2017-16613 (緊急 9.8) · Watchpost

← 脆弱性一覧

OpenStack Swauth object/proxy server writing Auth Token to log file

緊急 9.8CVE-2017-16613 · GHSA-qhq8-xwqv-pvv9 · PYSEC-2017-84 · 21/11/2017 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
swauth PyPI	`< 1.3.0`	`1.3.0`
swauth openstack	`≤ 1.2.0`	修正版なし
swift openstack	`≤ 2.15.1`	修正版なし

概要

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.

NVD の説明

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.

参考情報

nvd.nist.gov/vuln/detail/CVE-2017-16613 · ADVISORY
openstack/swauth commit 70af798 · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
bugs.launchpad.net/swift/+bug/1655781 · WEB
openstack/swauth · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227140059/http://www.securityfocus.com/bid/101926 · WEB
debian.org/security/2017/dsa-4044 · WEB
securityfocus.com/bid/101926 · Third Party Advisory
GitHub Advisory GHSA-qhq8-xwqv-pvv9 · ADVISORY

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン