SB2014012302 - Multiple vulnerabilities in Apple Swift
Published: January 23, 2014 Updated: August 10, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Cryptographic issues (CVE-ID: CVE-2013-6396)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
2) Information disclosure (CVE-ID: CVE-2014-0006)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
Remediation
Install update from vendor's website.