CVE-2014-0006

Advisory

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://bugs.launchpad.net/swift/+bug/1265665
• http://www.openwall.com/lists/oss-security/2014/01/17/5
• http://rhn.redhat.com/errata/RHSA-2014-0232.html
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0006
• https://nvd.nist.gov/vuln/detail/CVE-2014-0006
• https://github.com/openstack/swift/commit/754633988931e4095530f6b13389c254096eb485
• https://github.com/advisories/GHSA-cf9m-q836-vf26
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006