CVE-2014-7960
openstack-swift: Swift metadata constraints are not correctly enforced
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.
OpenStack Object Storage (Swift) anterior a 2.2.0 permite a usuarios remotos autenticados evadir las restricciones max_meta_count y otros metadatos a través de múlitples peticiones manipuladas que exceden el límite cuando éstas se combinan.
A flaw was found in the metadata constraints in OpenStack Object Storage (swift). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration.
OpenStack Object Storage provides object storage in virtual containers, which allows users to store and retrieve files. The service's distributed architecture supports horizontal scaling; redundancy as failure-proofing is provided through software-based data replication. Because Object Storage supports asynchronous eventual consistency replication, it is well suited to multiple data-center deployment. A flaw was found in the metadata constraints in OpenStack Object Storage. By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-10-07 CVE Reserved
- 2014-10-17 CVE Published
- 2024-08-06 CVE Updated
- 2025-04-01 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2014/10/07/39 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2014/10/08/7 | Mailing List |
|
| http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/70279 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/96901 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0835.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-0836.html | 2017-09-08 | |
| http://rhn.redhat.com/errata/RHSA-2015-1495.html | 2017-09-08 | |
| http://www.ubuntu.com/usn/USN-2704-1 | 2017-09-08 | |
| https://bugs.launchpad.net/swift/+bug/1365350 | 2017-09-08 | |
| https://access.redhat.com/security/cve/CVE-2014-7960 | 2015-07-29 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1150461 | 2015-07-29 |