CVE-2022-47950 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-47950 Interim 1 4 2023-06-05T23:18:16Z current 2023-02-10T00:25:18Z 2023-06-05T23:18:16Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-47950 An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2023-February/013703.html E-Mail link for SUSE-SU-2023:0323-1 https://lists.suse.com/pipermail/sle-updates/2023-June/029724.html E-Mail link for SUSE-SU-2023:2378-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openstack-heat-11.0.4~dev4-3.24.4 openstack-heat-api-11.0.4~dev4-3.24.4 openstack-heat-api-cfn-11.0.4~dev4-3.24.4 openstack-heat-engine-11.0.4~dev4-3.24.4 openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 openstack-swift openstack-swift-2.19.3~dev3-3.6.3 openstack-swift-account openstack-swift-account-2.19.3~dev3-3.6.3 openstack-swift-container openstack-swift-container-2.19.3~dev3-3.6.3 openstack-swift-object openstack-swift-object-2.19.3~dev3-3.6.3 openstack-swift-proxy openstack-swift-proxy-2.19.3~dev3-3.6.3 python-Werkzeug-0.14.1-3.6.2 python-heat-11.0.4~dev4-3.24.4 python-swift python-swift-2.19.3~dev3-3.6.3 python-swift3-1.7.0.dev372-3.3.1 venv-openstack-designate-x86_64-7.0.2~dev2-3.41.2 venv-openstack-heat-x86_64-11.0.4~dev4-3.43.2 venv-openstack-keystone-x86_64-14.2.1~dev9-3.42.2 venv-openstack-magnum-x86_64-7.2.1~dev1-4.41.3 venv-openstack-octavia-x86_64-3.2.3~dev7-4.41.2 venv-openstack-sahara-x86_64-9.0.2~dev15-3.41.2 venv-openstack-swift-x86_64-2.19.3~dev3-2.36.3 python-swift3-1.7.0.dev372-3.3.1 as a component of HPE Helion OpenStack 8 python-swift3-1.7.0.dev372-3.3.1 as a component of SUSE OpenStack Cloud 8 openstack-heat-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 openstack-heat-api-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 openstack-heat-api-cfn-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 openstack-heat-engine-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 openstack-swift-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 openstack-swift-account-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 openstack-swift-container-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 openstack-swift-object-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 openstack-swift-proxy-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 python-Werkzeug-0.14.1-3.6.2 as a component of SUSE OpenStack Cloud 9 python-heat-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud 9 python-swift-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud 9 venv-openstack-designate-x86_64-7.0.2~dev2-3.41.2 as a component of SUSE OpenStack Cloud 9 venv-openstack-heat-x86_64-11.0.4~dev4-3.43.2 as a component of SUSE OpenStack Cloud 9 venv-openstack-keystone-x86_64-14.2.1~dev9-3.42.2 as a component of SUSE OpenStack Cloud 9 venv-openstack-magnum-x86_64-7.2.1~dev1-4.41.3 as a component of SUSE OpenStack Cloud 9 venv-openstack-octavia-x86_64-3.2.3~dev7-4.41.2 as a component of SUSE OpenStack Cloud 9 venv-openstack-sahara-x86_64-9.0.2~dev15-3.41.2 as a component of SUSE OpenStack Cloud 9 venv-openstack-swift-x86_64-2.19.3~dev3-2.36.3 as a component of SUSE OpenStack Cloud 9 python-swift3-1.7.0.dev372-3.3.1 as a component of SUSE OpenStack Cloud Crowbar 8 openstack-heat-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-heat-api-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-heat-api-cfn-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-heat-engine-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift-account-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift-container-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift-object-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift-proxy-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 python-Werkzeug-0.14.1-3.6.2 as a component of SUSE OpenStack Cloud Crowbar 9 python-heat-11.0.4~dev4-3.24.4 as a component of SUSE OpenStack Cloud Crowbar 9 python-swift-2.19.3~dev3-3.6.3 as a component of SUSE OpenStack Cloud Crowbar 9 openstack-swift as a component of HPE Helion OpenStack 8 openstack-swift-account as a component of HPE Helion OpenStack 8 openstack-swift-container as a component of HPE Helion OpenStack 8 openstack-swift-object as a component of HPE Helion OpenStack 8 openstack-swift-proxy as a component of HPE Helion OpenStack 8 python-swift as a component of HPE Helion OpenStack 8 openstack-swift as a component of SUSE OpenStack Cloud 8 openstack-swift-account as a component of SUSE OpenStack Cloud 8 openstack-swift-container as a component of SUSE OpenStack Cloud 8 openstack-swift-object as a component of SUSE OpenStack Cloud 8 openstack-swift-proxy as a component of SUSE OpenStack Cloud 8 python-swift as a component of SUSE OpenStack Cloud 8 openstack-swift as a component of SUSE OpenStack Cloud Crowbar 8 openstack-swift-account as a component of SUSE OpenStack Cloud Crowbar 8 openstack-swift-container as a component of SUSE OpenStack Cloud Crowbar 8 openstack-swift-object as a component of SUSE OpenStack Cloud Crowbar 8 openstack-swift-proxy as a component of SUSE OpenStack Cloud Crowbar 8 python-swift as a component of SUSE OpenStack Cloud Crowbar 8 An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed). CVE-2022-47950 HPE Helion OpenStack 8:python-swift3-1.7.0.dev372-3.3.1 SUSE OpenStack Cloud 8:python-swift3-1.7.0.dev372-3.3.1 SUSE OpenStack Cloud 9:openstack-heat-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:openstack-heat-api-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:openstack-heat-api-cfn-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:openstack-heat-engine-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:openstack-swift-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:openstack-swift-account-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:openstack-swift-container-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:openstack-swift-object-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:openstack-swift-proxy-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:python-Werkzeug-0.14.1-3.6.2 SUSE OpenStack Cloud 9:python-heat-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud 9:python-swift-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud 9:venv-openstack-designate-x86_64-7.0.2~dev2-3.41.2 SUSE OpenStack Cloud 9:venv-openstack-heat-x86_64-11.0.4~dev4-3.43.2 SUSE OpenStack Cloud 9:venv-openstack-keystone-x86_64-14.2.1~dev9-3.42.2 SUSE OpenStack Cloud 9:venv-openstack-magnum-x86_64-7.2.1~dev1-4.41.3 SUSE OpenStack Cloud 9:venv-openstack-octavia-x86_64-3.2.3~dev7-4.41.2 SUSE OpenStack Cloud 9:venv-openstack-sahara-x86_64-9.0.2~dev15-3.41.2 SUSE OpenStack Cloud 9:venv-openstack-swift-x86_64-2.19.3~dev3-2.36.3 SUSE OpenStack Cloud Crowbar 8:python-swift3-1.7.0.dev372-3.3.1 SUSE OpenStack Cloud Crowbar 9:openstack-heat-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:openstack-heat-api-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:openstack-heat-api-cfn-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:openstack-heat-engine-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:openstack-swift-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud Crowbar 9:openstack-swift-account-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud Crowbar 9:openstack-swift-container-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud Crowbar 9:openstack-swift-object-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud Crowbar 9:openstack-swift-proxy-2.19.3~dev3-3.6.3 SUSE OpenStack Cloud Crowbar 9:python-Werkzeug-0.14.1-3.6.2 SUSE OpenStack Cloud Crowbar 9:python-heat-11.0.4~dev4-3.24.4 SUSE OpenStack Cloud Crowbar 9:python-swift-2.19.3~dev3-3.6.3 HPE Helion OpenStack 8:openstack-swift HPE Helion OpenStack 8:openstack-swift-account HPE Helion OpenStack 8:openstack-swift-container HPE Helion OpenStack 8:openstack-swift-object HPE Helion OpenStack 8:openstack-swift-proxy HPE Helion OpenStack 8:python-swift SUSE OpenStack Cloud 8:openstack-swift SUSE OpenStack Cloud 8:openstack-swift-account SUSE OpenStack Cloud 8:openstack-swift-container SUSE OpenStack Cloud 8:openstack-swift-object SUSE OpenStack Cloud 8:openstack-swift-proxy SUSE OpenStack Cloud 8:python-swift SUSE OpenStack Cloud Crowbar 8:openstack-swift SUSE OpenStack Cloud Crowbar 8:openstack-swift-account SUSE OpenStack Cloud Crowbar 8:openstack-swift-container SUSE OpenStack Cloud Crowbar 8:openstack-swift-object SUSE OpenStack Cloud Crowbar 8:openstack-swift-proxy SUSE OpenStack Cloud Crowbar 8:python-swift important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N