{"id":"CVE-2014-7960","published":"2014-10-17T15:00:00Z","modified":"2024-08-06T13:03:27Z","title":"OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other…","vendor":null,"product":null,"tier":"tail","description":{"text":"OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03049,"percentile":0.87499,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/08/7","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugs.launchpad.net/swift/+bug/1365350","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1495.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0835.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/96901","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/07/39","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-2704-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/70279","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0836.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":17.5}]},"affected":[{"ecosystem":"PyPI","package":"swift","vulnerableRanges":["<2.2.0"],"patched":["2.2.0"],"from":["GHSA-g6x3-55qv-x6p2","PYSEC-2026-933"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3908","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-swift-cve-2013-2161","parents":[{"from":"CVE-2013-2161","to":"CVE-2014-7960","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["swift/account/server.py"],"commits":["https://github.com/openstack/swift/commit/6659382c4fa348e1ebbce2424968dd7267ea1db1","https://github.com/openstack/swift/commit/8f9b135e0a16478a628f20224ce5babe62d4aaba","https://github.com/openstack/swift/commit/06800cbe446ce4c937a57b69517b55c3bba9b6e1","https://github.com/openstack/swift/commit/2c4622a28ea04e1c6b2382189b0a1f6cccdc9c0f"],"basis":"rarely changed file"}]},{"from":"CVE-2013-4155","to":"CVE-2014-7960","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["swift/obj/diskfile.py"],"commits":["https://github.com/openstack/swift/commit/1f4ec235cdfd8c868f2d6458532f9dc32c00b8ca","https://github.com/openstack/swift/commit/6b9806e0e8cbec60c0a3ece0bd516e0502827515","https://github.com/openstack/swift/commit/06800cbe446ce4c937a57b69517b55c3bba9b6e1","https://github.com/openstack/swift/commit/2c4622a28ea04e1c6b2382189b0a1f6cccdc9c0f"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2013-4155","published":"2013-08-20","fixed":"1.9.1","kev":false},{"cve":"CVE-2014-0006","published":"2014-01-23","fixed":"1.12.0","kev":false},{"cve":"CVE-2014-3497","published":"2014-07-03","fixed":"2.0.0","kev":false,"link":{"from":"CVE-2014-3497","to":"CVE-2014-7960","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:swift","fromFixed":"2.0.0","toFixed":"2.2.0","daysApart":106}]}},{"cve":"CVE-2014-7960","published":"2014-10-17","fixed":"2.2.0","kev":false},{"cve":"CVE-2015-1856","published":"2015-04-17","fixed":"2.3.0","kev":false,"link":{"from":"CVE-2014-7960","to":"CVE-2015-1856","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:swift","fromFixed":"2.2.0","toFixed":"2.3.0","daysApart":182}]}},{"cve":"CVE-2015-5223","published":"2015-10-26","fixed":"2.4.0","kev":false},{"cve":"CVE-2016-0737","published":"2016-01-29","fixed":"2.4.0","kev":false}],"package":"PyPI:swift"}}