Vulnerability CVE-2013-4155

Vulnerability Name:

CVE-2013-4155 (CCN-86302)

Assigned:

2013-08-07

Published:

2013-08-07

Updated:

2013-10-31

Summary:

OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.

CVSS v3 Severity:

3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2013-4155

Source: CCN
Type: OSSA 2013-022
Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)

Source: REDHAT
Type: UNKNOWN
RHSA-2013:1197

Source: CCN
Type: oss-sec Mailing List, Wed, 07 Aug 2013 17:48:28 +0200
[OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)

Source: DEBIAN
Type: UNKNOWN
DSA-2737

Source: DEBIAN
Type: DSA-2737
swift -- several vulnerabilities

Source: MLIST
Type: UNKNOWN
[oss-security] 20130807 [OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)

Source: CCN
Type: BID-61690
OpenStack Swift CVE-2013-4155 Denial of Service Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2001-1

Source: CONFIRM
Type: UNKNOWN
https://bugs.launchpad.net/swift/+bug/1196932

Source: XF
Type: UNKNOWN
openstack-swift-cve20134155-dos(86302)

Source: MISC
Type: UNKNOWN
https://review.openstack.org/#/c/40643/

Source: MISC
Type: UNKNOWN
https://review.openstack.org/#/c/40645/

Source: CCN
Type: OpenStack Web site
Change I63195702: Fix handling of DELETE obj reqs with old timestamp

Source: MISC
Type: UNKNOWN
https://review.openstack.org/#/c/40646/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-4155

Vulnerable Configuration:

Configuration 1:

cpe:/a:openstack:folsom:-:*:*:*:*:*:*:*

OR cpe:/a:openstack:grizzly:-:*:*:*:*:*:*:*

OR cpe:/a:openstack:havana:-:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.1.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.3.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.1:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.2:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.3:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.4:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.5:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.6:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.7:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.4.8:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.5.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.6.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.7.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.7.2:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.7.4:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.7.5:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.7.6:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.8.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.8.0:rc1:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.8.0:rc2:*:*:*:*:*:*

OR cpe:/a:openstack:swift:*:*:*:*:*:*:*:* (Version <= 1.9.0)

Configuration CCN 1:

cpe:/a:openstack:swift:1.7.4:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.8.0:*:*:*:*:*:*:*

OR cpe:/a:openstack:swift:1.9.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:19335	P	USN-2001-1 -- swift vulnerability	2014-06-30
oval:org.mitre.oval:def:18787	P	DSA-2737-1 swift - several	2014-06-23
oval:com.ubuntu.precise:def:20134155000	V	CVE-2013-4155 on Ubuntu 12.04 LTS (precise) - medium.	2013-08-20

BACK