CVE-2014-3497

Advisory

Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.


MLIST:[openstack-announce] 20140619 [OSSA 2014-020] XSS in Swift requests through WWW-Authenticate header (CVE-2014-3497): http://lists.openstack.org/pipermail/openstack-announce/2014-June/000243.html
MLIST:[oss-security] 20140619 [OSSA 2014-020] XSS in Swift requests through WWW-Authenticate header (CVE-2014-3497): http://www.openwall.com/lists/oss-security/2014/06/19/10
CONFIRM:https://review.openstack.org/#/c/101031/: https://review.openstack.org/#/c/101031/
CONFIRM:https://review.openstack.org/#/c/101032/: https://review.openstack.org/#/c/101032/
UBUNTU:USN-2256-1: http://www.ubuntu.com/usn/USN-2256-1
BID:68116: http://www.securityfocus.com/bid/68116
SECUNIA:59532: http://secunia.com/advisories/59532

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3497
• https://review.openstack.org/#/c/101031/
• http://www.ubuntu.com/usn/USN-2256-1
• http://www.openwall.com/lists/oss-security/2014/06/19/10
• http://secunia.com/advisories/59532
• https://review.openstack.org/#/c/101032/
• http://lists.openstack.org/pipermail/openstack-announce/2014-June/000243.html
• http://www.securityfocus.com/bid/68116