CVE-2022-47950

Publication date 18 January 2023

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
swift	24.10 oracular	Fixed 2.31.0+git2023020814.488f8c83-0ubuntu1
	24.04 LTS noble	Fixed 2.31.0+git2023020814.488f8c83-0ubuntu1
	23.10 mantic	Fixed 2.31.0+git2023020814.488f8c83-0ubuntu1
	23.04 lunar	Fixed 2.31.0+git2023020814.488f8c83-0ubuntu1
	22.10 kinetic	Fixed 2.30.1-0ubuntu1
	22.04 LTS jammy	Fixed 2.29.2-0ubuntu1
	20.04 LTS focal	Fixed 2.25.2-0ubuntu1.1
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Vulnerable
	14.04 LTS trusty	Ignored end of standard support

Notes

mdeslaur

s3api was introduced in 2.18, and swift3 was not shipped by Ubuntu

Severity score breakdown

Parameter	Value
Base score	6.5 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-5852-1
OpenStack Swift vulnerability
9 February 2023