p PatchFirst

CVE-2022-47950

CVE-2022-47950

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

CVSS 6.5 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • swift Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.30.0-4

    Update to 2.30.0-4

  • swift Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.30.0-4

    Update to 2.30.0-4

  • swift Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.30.0-4

    Update to 2.30.0-4

  • swift PyPI

    Versions
    • 1.0.2
    • 2.15.2
    • 2.17.1
    • 2.19.1
    • 2.19.2
    • 2.20.0
    • 2.21.0
    • 2.21.1
    • 2.22.0
    • 2.23.0
    • 2.23.1
    • 2.23.2
    • 2.23.3
    • 2.24.0
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.26.0
    • 2.27.0
    • 2.28.0
    Affected ranges
    • ECOSYSTEM: < 2.28.1

    Update to 2.28.1

  • swift PyPI

    Versions
    • 2.29.0
    • 2.29.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.29.0, < 2.29.2

    Update to 2.29.2

  • swift PyPI

    Versions
    • 2.30.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.30.0, < 2.30.1

    Update to 2.30.1

  • swift PyPI

    Versions
    • 1.0.2
    • 2.15.2
    • 2.17.1
    • 2.19.1
    • 2.19.2
    • 2.20.0
    • 2.21.0
    • 2.21.1
    • 2.22.0
    • 2.23.0
    • 2.23.1
    • 2.23.2
    • 2.23.3
    • 2.24.0
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.26.0
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.29.1
    • 2.30.0
    Affected ranges
    • ECOSYSTEM: < 2.28.1 ∪ ≥ 2.29.0, < 2.29.2 ∪ ≥ 2.30.0, < 2.30.1

    Update to 2.28.1; Update to 2.29.2; Update to 2.30.1

  • swift Ubuntu:16.04:LTS

    Versions
    • 2.5.0-0ubuntu1
    • 2.7.0-0ubuntu2
    • 2.7.0-0ubuntu2.1
    • 2.7.1-0ubuntu1
    • 2.7.1-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • swift Ubuntu:20.04:LTS

    Versions
    • 2.23.0-0ubuntu1
    • 2.23.1-0ubuntu1
    • 2.24.0~git2019121715.e890b0f0f-0ubuntu1
    • 2.24.0-0ubuntu1
    • 2.24.1~git2020032711.712bf3c9f-0ubuntu2
    • 2.24.1~git2020041316.a495f1e32-0ubuntu1
    • 2.25.0-0ubuntu0.20.04.1
    • 2.25.1-0ubuntu1
    • 2.25.2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.25.2-0ubuntu1.1

    Update to 2.25.2-0ubuntu1.1

  • swift Ubuntu:22.04:LTS

    Versions
    • 2.28.0+git2021090911.5d52afbe4-0ubuntu1
    • 2.28.0+git2021120815.1859f2e16-0ubuntu1
    • 2.28.0+git2021121320.876377435-0ubuntu1
    • 2.28.0+git2022011309.32da73f5c-0ubuntu1
    • 2.29.0+git2022030314.3ff3076ce-0ubuntu1
    • 2.29.0+git2022030314.3ff3076ce-0ubuntu2
    • 2.29.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.29.2-0ubuntu1

    Update to 2.29.2-0ubuntu1

Original sources

Check your server →