Cloudanix VulnDB

CVE-2014-7960

None

CVSS

—

EPSS

3.0%

Published

Oct 17, 2014

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Users who already have login access can quietly store more descriptive information about files than administrators intended, potentially bypassing storage rules.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote authenticated users can bypass configured metadata limits such as max_meta_count by issuing multiple individually compliant requests whose cumulative effect exceeds the enforced threshold.

Why it matters to the business

Attackers with valid credentials can store more metadata than policy permits, leading to uncontrolled object growth, potential storage quota evasion, and violation of data-governance rules.

How an attack unfolds

An authenticated user repeatedly issues crafted storage requests, each staying under per-request metadata caps, until the aggregate count or size of stored metadata exceeds the configured maximum, effectively disabling the intended constraint.

How to fix it

Upgrade OpenStack Swift to version 2.2.0 or later; after upgrade, restart all proxy, account, container, and object services and confirm the new version string in /info or swift --version output.

How to confirm the fix worked

Query the Swift version endpoint or package manager to confirm 2.2.0 or newer; attempt a test sequence of metadata requests that would have previously exceeded limits and verify that the server now rejects the cumulative set.

Typical attack path

  1. Obtain valid Swift authentication credentials
  2. Identify an object or container subject to metadata limits
  3. Issue multiple PUT/POST requests each containing a small number of X-Object-Meta- or X-Container-Meta- headers
  4. Continue until the cumulative metadata count or size exceeds the enforced limit
  5. Verify bypass by retrieving the object/container metadata listing

How to detect it

Inspect Swift proxy and object-server logs for repeated PUT/POST operations from the same authenticated user against the same object or container within short time windows; correlate with metadata-header counts per request.

What your security team should do

  • Immediately schedule upgrade of all Swift deployments to 2.2.0 or newer
  • Review and tighten metadata-related configuration parameters after patching
  • Enable request logging at the proxy layer to monitor high-frequency metadata operations
  • Audit existing objects for unexpectedly large metadata counts

The record

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

Affected packages

Ecosystem Package Introduced Fixed
PyPI swift 0 2.2.0
Debian:11 swift 0 2.2.0-1
Debian:12 swift 0 2.2.0-1
Debian:13 swift 0 2.2.0-1
Red Hat:openstack:5::el6 openstack-swift 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el6 openstack-swift-account 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el6 openstack-swift-container 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el6 openstack-swift-doc 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el6 openstack-swift-object 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el6 openstack-swift-proxy 0 0:1.13.1-4.el6ost
Red Hat:openstack:5::el7 openstack-swift 0 0:1.13.1-4.el7ost
Red Hat:openstack:5::el7 openstack-swift-account 0 0:1.13.1-4.el7ost
Red Hat:openstack:5::el7 openstack-swift-container 0 0:1.13.1-4.el7ost
Red Hat:openstack:5::el7 openstack-swift-doc 0 0:1.13.1-4.el7ost
Red Hat:openstack:5::el7 openstack-swift-object 0 0:1.13.1-4.el7ost
Red Hat:openstack:5::el7 openstack-swift-proxy 0 0:1.13.1-4.el7ost
Red Hat:storage:2:client:el5 glusterfs 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-api 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-api-devel 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-cli 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-client-xlators 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-debuginfo 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-devel 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-fuse 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-libs 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 glusterfs-rdma 0 0:3.7.1-11.el5
Red Hat:storage:2:client:el5 python-gluster 0 0:3.7.1-11.el5
Red Hat:storage:3.1:nagios:el6 check-mk 0 0:1.2.6p1-3.el6rhs
Red Hat:storage:3.1:nagios:el6 check-mk-debuginfo 0 0:1.2.6p1-3.el6rhs
Red Hat:storage:3.1:nagios:el6 check-mk-livestatus 0 0:1.2.6p1-3.el6rhs
Red Hat:storage:3.1:nagios:el6 gluster-nagios-common 0 0:0.2.0-1.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-debuginfo 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-dummy 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-ide_smart 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-nrpe 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-ping 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-plugins-procs 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:nagios:el6 nagios-server-addons 0 0:0.2.1-4.el6rhs
Red Hat:storage:3.1:nagios:el6 nrpe 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:nagios:el6 nrpe-debuginfo 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:nagios:el6 pnp4nagios 0 0:0.6.22-2.1.el6rhs
Red Hat:storage:3.1:nagios:el6 pnp4nagios-debuginfo 0 0:0.6.22-2.1.el6rhs
Red Hat:storage:3.1:nagios:el6 pynag 0 0:0.9.1-1.el6rhs
Red Hat:storage:3.1:nagios:el6 pynag-examples 0 0:0.9.1-1.el6rhs
Red Hat:storage:3.1:nagios:el6 python-cpopen 0 0:1.3-4.el6_5
Red Hat:storage:3.1:nagios:el6 python-cpopen-debuginfo 0 0:1.3-4.el6_5
Red Hat:storage:3.1:nfs:el6 nfs-ganesha 0 0:2.2.0-5.el6rhs
Red Hat:storage:3.1:nfs:el6 nfs-ganesha-debuginfo 0 0:2.2.0-5.el6rhs
Red Hat:storage:3.1:nfs:el6 nfs-ganesha-gluster 0 0:2.2.0-5.el6rhs
Red Hat:storage:3.1:nfs:el6 nfs-ganesha-nullfs 0 0:2.2.0-5.el6rhs
Red Hat:storage:3.1:samba:el6 libtalloc 0 0:2.1.1-4.el6rhs
Red Hat:storage:3.1:samba:el6 libtalloc-debuginfo 0 0:2.1.1-4.el6rhs
Red Hat:storage:3.1:samba:el6 libtalloc-devel 0 0:2.1.1-4.el6rhs
Red Hat:storage:3.1:samba:el6 pytalloc 0 0:2.1.1-4.el6rhs
Red Hat:storage:3.1:samba:el6 pytalloc-devel 0 0:2.1.1-4.el6rhs
Red Hat:storage:3.1:server:el6 augeas 0 0:1.0.0-10.el6
Red Hat:storage:3.1:server:el6 augeas-debuginfo 0 0:1.0.0-10.el6
Red Hat:storage:3.1:server:el6 augeas-devel 0 0:1.0.0-10.el6
Red Hat:storage:3.1:server:el6 augeas-libs 0 0:1.0.0-10.el6
Red Hat:storage:3.1:server:el6 ccs 0 0:0.16.2-81.el6
Red Hat:storage:3.1:server:el6 clufter 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 clufter-cli 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 clufter-debuginfo 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 clufter-lib-ccs 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 clufter-lib-general 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 clufter-lib-pcs 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 cluster 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 cluster-cim 0 0:0.16.2-31.el6
Red Hat:storage:3.1:server:el6 cluster-debuginfo 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 cluster-snmp 0 0:0.16.2-31.el6
Red Hat:storage:3.1:server:el6 clusterlib 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 clusterlib-devel 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 clustermon 0 0:0.16.2-31.el6
Red Hat:storage:3.1:server:el6 clustermon-debuginfo 0 0:0.16.2-31.el6
Red Hat:storage:3.1:server:el6 cman 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 corosync 0 0:1.4.7-2.el6
Red Hat:storage:3.1:server:el6 corosync-debuginfo 0 0:1.4.7-2.el6
Red Hat:storage:3.1:server:el6 corosynclib 0 0:1.4.7-2.el6
Red Hat:storage:3.1:server:el6 corosynclib-devel 0 0:1.4.7-2.el6
Red Hat:storage:3.1:server:el6 ctdb2.5 0 0:2.5.5-7.el6rhs
Red Hat:storage:3.1:server:el6 ctdb2.5-debuginfo 0 0:2.5.5-7.el6rhs
Red Hat:storage:3.1:server:el6 fence-virt 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virt-debuginfo 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virtd 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virtd-checkpoint 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virtd-libvirt 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virtd-multicast 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 fence-virtd-serial 0 0:0.2.3-19.el6
Red Hat:storage:3.1:server:el6 gfs2-utils 0 0:3.0.12.1-73.el6
Red Hat:storage:3.1:server:el6 gluster-nagios-addons 0 0:0.2.4-4.el6rhs
Red Hat:storage:3.1:server:el6 gluster-nagios-addons-debuginfo 0 0:0.2.4-4.el6rhs
Red Hat:storage:3.1:server:el6 gluster-nagios-common 0 0:0.2.0-1.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-api 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-api-devel 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-cli 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-client-xlators 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-debuginfo 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-devel 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-fuse 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-ganesha 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-geo-replication 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-libs 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-rdma 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 glusterfs-server 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 gstatus 0 0:0.64-3.1.el6rhs
Red Hat:storage:3.1:server:el6 gstatus-debuginfo 0 0:0.64-3.1.el6rhs
Red Hat:storage:3.1:server:el6 libqb 0 0:0.17.1-1.el6
Red Hat:storage:3.1:server:el6 libqb-debuginfo 0 0:0.17.1-1.el6
Red Hat:storage:3.1:server:el6 libqb-devel 0 0:0.17.1-1.el6
Red Hat:storage:3.1:server:el6 libvirt-debuginfo 0 0:0.10.2-54.el6
Red Hat:storage:3.1:server:el6 libvirt-lock-sanlock 0 0:0.10.2-54.el6
Red Hat:storage:3.1:server:el6 modcluster 0 0:0.16.2-31.el6
Red Hat:storage:3.1:server:el6 nagios-plugins 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-debuginfo 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-dummy 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-ide_smart 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-nrpe 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-ping 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nagios-plugins-procs 0 0:1.4.16-12.el6rhs
Red Hat:storage:3.1:server:el6 nrpe 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:server:el6 nrpe-debuginfo 0 0:2.15-4.1.el6rhs
Red Hat:storage:3.1:server:el6 openais 0 0:1.1.1-7.el6
Red Hat:storage:3.1:server:el6 openais-debuginfo 0 0:1.1.1-7.el6
Red Hat:storage:3.1:server:el6 openaislib 0 0:1.1.1-7.el6
Red Hat:storage:3.1:server:el6 openaislib-devel 0 0:1.1.1-7.el6
Red Hat:storage:3.1:server:el6 openstack-swift 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 openstack-swift-account 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 openstack-swift-container 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 openstack-swift-doc 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 openstack-swift-object 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 openstack-swift-proxy 0 0:1.13.1-4.el6ost
Red Hat:storage:3.1:server:el6 pacemaker 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-cli 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-cluster-libs 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-cts 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-debuginfo 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-doc 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-libs 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-libs-devel 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pacemaker-remote 0 0:1.1.12-8.el6
Red Hat:storage:3.1:server:el6 pcs 0 0:0.9.139-9.el6
Red Hat:storage:3.1:server:el6 pcs-debuginfo 0 0:0.9.139-9.el6
Red Hat:storage:3.1:server:el6 python-blivet 0 1:1.0.0.2-1.el6rhs
Red Hat:storage:3.1:server:el6 python-clufter 0 0:0.11.2-1.el6
Red Hat:storage:3.1:server:el6 python-cpopen 0 0:1.3-4.el6_5
Red Hat:storage:3.1:server:el6 python-cpopen-debuginfo 0 0:1.3-4.el6_5
Red Hat:storage:3.1:server:el6 python-eventlet 0 0:0.14.0-1.el6
Red Hat:storage:3.1:server:el6 python-eventlet-doc 0 0:0.14.0-1.el6
Red Hat:storage:3.1:server:el6 python-gluster 0 0:3.7.1-11.el6rhs
Red Hat:storage:3.1:server:el6 python-greenlet 0 0:0.4.2-1.el6
Red Hat:storage:3.1:server:el6 python-greenlet-debuginfo 0 0:0.4.2-1.el6
Red Hat:storage:3.1:server:el6 python-greenlet-devel 0 0:0.4.2-1.el6
Red Hat:storage:3.1:server:el6 python-keystoneclient 0 1:0.9.0-5.el6ost
Red Hat:storage:3.1:server:el6 python-keystoneclient-doc 0 1:0.9.0-5.el6ost
Red Hat:storage:3.1:server:el6 python-prettytable 0 0:0.7.2-1.el6
Red Hat:storage:3.1:server:el6 python-pyudev 0 0:0.15-2.el6rhs
Red Hat:storage:3.1:server:el6 redhat-storage-logos 0 0:60.0.20-1.el6rhs
Red Hat:storage:3.1:server:el6 redhat-storage-server 0 0:3.1.0.3-1.el6rhs
Red Hat:storage:3.1:server:el6 resource-agents 0 0:3.9.5-24.el6
Red Hat:storage:3.1:server:el6 resource-agents-debuginfo 0 0:3.9.5-24.el6
Red Hat:storage:3.1:server:el6 resource-agents-sap 0 0:3.9.5-24.el6
Red Hat:storage:3.1:server:el6 ricci 0 0:0.16.2-81.el6
Red Hat:storage:3.1:server:el6 ricci-debuginfo 0 0:0.16.2-81.el6
Red Hat:storage:3.1:server:el6 userspace-rcu 0 0:0.7.9-2.el6rhs
Red Hat:storage:3.1:server:el6 userspace-rcu-debuginfo 0 0:0.7.9-2.el6rhs
Red Hat:storage:3.1:server:el6 userspace-rcu-devel 0 0:0.7.9-2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-cli 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-debug-plugin 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-debuginfo 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-gluster 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-hook-ethtool-options 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-hook-faqemu 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-hook-openstacknet 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-hook-qemucmdline 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-jsonrpc 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-python 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-python-zombiereaper 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-reg 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-tests 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-xmlrpc 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3.1:server:el6 vdsm-yajsonrpc 0 0:4.16.20-1.2.el6rhs
Red Hat:storage:3:client:el6 glusterfs 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-api 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-api-devel 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-cli 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-client-xlators 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-debuginfo 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-devel 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-fuse 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-libs 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 glusterfs-rdma 0 0:3.7.1-11.el6
Red Hat:storage:3:client:el6 python-gluster 0 0:3.7.1-11.el6
SUSE:OpenStack Cloud 5 openstack-swift 0 2.1.0-11.1
SUSE:OpenStack Cloud 5 openstack-swift-doc 0 2.1.0-11.1
Ubuntu:14.04:LTS swift 0 1.13.1-0ubuntu1.2

Related vulnerabilities