Every CVE Search/ Get API key

CVE-2014-0006

OpenStack Swift Discloses Secret URLs to Timing Attack

4.3 MediumFix available

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Exploit likelihood

1.92%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
CVE-2014-0006
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
CVE-2014-0006
Updated
2026-11-02
EUVDEUVD-2014-0107 No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
EUVD-2014-0107
Updated
2026-11-03
GitHub AdvisoriesGHSA-cf9m-q836-vf26 8.7

OpenStack Swift Discloses Secret URLs to Timing Attack

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
GHSA-cf9m-q836-vf26
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-cf9m-q836-vf26 8.7

OpenStack Swift Discloses Secret URLs to Timing Attack

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
GHSA-cf9m-q836-vf26
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
CVE-2014-0006
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0006 No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
DEBIAN-CVE-2014-0006
Updated
2026-11-02
OSVPYSEC-2014-116 No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
PYSEC-2014-116
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0006 No score

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

Record
UBUNTU-CVE-2014-0006
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
swift
PyPI
 1.4.6 to 1.8.0 None known
swift
PyPI
 1.9.0 to 1.10.0 None known
swift
PyPI
 1.11.0 to 1.11.0
1.12.0
swift
Debian:12
 before 1.11.0-2
1.11.0-2
swift
Debian:13
 before 1.11.0-2
1.11.0-2
swift
Debian:14
 before 1.11.0-2
1.11.0-2
swift
PyPI
 1.11.0 up to 1.12.0
1.12.0
swift
PyPI
 1.4.6 up to 1.12.0, plus listed versions
1.11.0
1.12.0
openstack-swift
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
openstack-swift-account
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
Show 10 moreShow less
Affected packages
PackageAffectedFixed
openstack-swift-container
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
openstack-swift-doc
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
openstack-swift-object
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
openstack-swift-proxy
Red Hat:openstack:4::el6
 before 0:1.10.0-3.el6ost
0:1.10.0-3.el6ost
openstack-swift
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost
openstack-swift-account
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost
openstack-swift-container
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost
openstack-swift-doc
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost
openstack-swift-object
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost
openstack-swift-proxy
Red Hat:openstack:3::el6
 before 0:1.8.0-8.el6ost
0:1.8.0-8.el6ost

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0006 is a medium vulnerability (CVSS 4.3) in Openstack Swift, published January 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. Fixed in swift 1.12.0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open