USN-2256-1: Swift vulnerability

Releases

• Ubuntu 14.04 ESM

Packages

• swift - OpenStack distributed virtual object store

Details

John Dickinson discovered that Swift did not properly quote the
WWW-Authenticate header value. If a user were tricked into navigating to a
malicious Swift URL, an attacker could conduct cross-site scripting
attacks. With cross-site scripting vulnerabilities, if a user were tricked
into viewing server output during a crafted server request, a remote
attacker could exploit this to modify the contents, or steal confidential
data, within the same domain.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04

• python-swift - 1.13.1-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2014-3497