CVE-2022-47950

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

This update for python-swift3 fixes the following issues:

• CVE-2022-47950: Fixed an issue that could allow a remote attacker to disclose local file contents via a crafted XML file (bsc#1207035).

This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes:

Security fixes included in this update:

openstack-heat:

• CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment (bsc#1209774).

openstack-swift:

• CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035).

python-Werkzeug:

• CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283).

Non security changes on this update:

Changes in openstack-heat:

• Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625)

Changes in openstack-swift:

• Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950)

Changes in python-Werkzeug;

• Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)

It was discovered that OpenStack Swift incorrectly handled certain XML files. A remote authenticated user could possibly use this issue to obtain arbitrary file contents containing sensitive information from the server.