{"id":"CVE-2015-5223","aliases":["DEBIAN-CVE-2015-5223","EUVD-2022-4873","GHSA-q45h-chc8-hvp6","PYSEC-2026-934","RHSA-2015:1895","RHSA-2016:0328","RHSA-2016:0329","SUSE-SU-2015:1846-1","UBUNTU-CVE-2015-5223","USN-3451-1"],"status":"published","title":"OpenStack Object Storage (Swift) Sensitive Data Exposure","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02605,"percentile":0.85489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-10-19T09:00:52Z","modified":"2026-10-08T10:01:13Z","fixes":[{"ecosystem":"PyPI","package":"swift","fixed_in":["2.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"swift","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"swift","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"swift","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-account","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-container","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-doc","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-object","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-proxy","fixed_in":["0:1.13.1-7.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-account","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-container","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-doc","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-object","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-proxy","fixed_in":["0:1.13.1-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-account","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-container","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-doc","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-object","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-proxy","fixed_in":["0:2.2.0-5.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-account","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-container","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-doc","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-object","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-proxy","fixed_in":["0:2.3.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"swift","fixed_in":["1.13.1-0ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["1.0.2"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["1.0.2"]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-5.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el7","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:storage:3.1:server:el6","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-0ubuntu1.5"}]}],"versions":["1.10.0~rc1-0ubuntu1","1.10.0-0ubuntu1","1.11.0-0ubuntu2","1.12.0-0ubuntu1","1.13.0-0ubuntu1","1.13.1~rc1-0ubuntu2","1.13.1~rc2-0ubuntu1","1.13.1-0ubuntu1","1.13.1-0ubuntu1.1","1.13.1-0ubuntu1.2","1.13.1-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-0ubuntu1.5"}]}],"versions":["1.10.0~rc1-0ubuntu1","1.10.0-0ubuntu1","1.11.0-0ubuntu2","1.12.0-0ubuntu1","1.13.0-0ubuntu1","1.13.1~rc1-0ubuntu2","1.13.1~rc2-0ubuntu1","1.13.1-0ubuntu1","1.13.1-0ubuntu1.1","1.13.1-0ubuntu1.2","1.13.1-0ubuntu1.3"],"bundled":3}],"products":[{"vendor":"openstack","product":"swift"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0329.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2015-016.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1895.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/84827","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://bugs.launchpad.net/swift/+bug/1449212","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/08/26/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugs.launchpad.net/swift/+bug/1453948","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5223","tags":["advisory"]},{"url":"https://web.archive.org/web/20200804233308/http://www.securityfocus.com/bid/84827","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q45h-chc8-hvp6","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5223","tags":["advisory"]},{"url":"https://github.com/openstack/swift","tags":["package"]},{"url":"https://pypi.org/project/swift","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1895","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255622","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1895.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5223","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0328","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0328.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0737","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0738","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0329","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0329.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151846-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/900253","tags":["report"]},{"url":"https://bugzilla.suse.com/927793","tags":["report"]},{"url":"https://bugzilla.suse.com/942641","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5223","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5223","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3451-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-0737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0738","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5223","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T17:00:00Z","modified":"2024-08-06T06:41:08.643Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2022-4873","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T17:00:00Z","modified":"2024-08-06T06:41:08Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-q45h-chc8-hvp6","title":"OpenStack Object Storage (Swift) Sensitive Data Exposure","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2022-05-14T03:59:06Z","modified":"2023-08-01T21:18:59Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2015-5223","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T17:59:05.483Z","modified":"2026-06-17T00:28:42.473Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"CVE-2015-5223","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T17:59:05Z","modified":"2026-07-07T11:56:49.474840188Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5223","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T17:59:05.483Z","modified":"2026-09-09T06:47:22.348582899Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-q45h-chc8-hvp6","title":"OpenStack Object Storage (Swift) Sensitive Data Exposure","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2022-05-14T03:59:06Z","modified":"2026-07-07T11:56:49.474840188Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"PYSEC-2026-934","title":"OpenStack Object Storage (Swift) Sensitive Data Exposure","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2026-07-06T08:03:24.187398Z","modified":"2026-07-07T11:45:51.673517039Z","updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2015:1895","title":"Red Hat Security Advisory: openstack-swift security update","status":"published","published":"2024-09-13T10:38:11Z","modified":"2026-08-01T10:02:28Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2016:0328","title":"Red Hat Security Advisory: openstack-swift security update","status":"published","published":"2024-09-13T12:26:54Z","modified":"2026-10-08T10:01:12Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0329","title":"Red Hat Security Advisory: openstack-swift security update","status":"published","published":"2024-09-13T12:26:49Z","modified":"2026-10-08T10:01:13Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2015:1846-1","title":"Security update for openstack-swift","description":"openstack-swift was updated to fix three security issues.\n\nThese security issues were fixed:\n- CVE-2015-1856: OpenStack Object Storage (Swift), when allow_version is configured, allowed remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container (bsc#927793).\n- CVE-2014-7960: OpenStack Object Storage (Swift) allowed remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined (bsc#900253).\n- CVE-2015-5223: Information leak via Swift tempurls (bsc#942641).\n  ","status":"published","published":"2015-10-19T09:00:52Z","modified":"2026-02-04T02:49:50.975769Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-5223","description":"OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.","status":"published","published":"2015-10-26T00:00:00Z","modified":"2026-02-04T04:21:11.968462Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-3451-1","title":"swift vulnerabilities","description":"It was discovered that OpenStack Swift incorrectly handled tempurls. A\nremote authenticated user in possession of a tempurl key authorized for PUT\ncould retrieve other objects in the same Swift account. (CVE-2015-5223)\n\nRomain Le Disez and Örjan Persson discovered that OpenStack Swift\nincorrectly closed client connections. A remote attacker could possibly use\nthis issue to consume resources, resulting in a denial of service.\n(CVE-2016-0737, CVE-2016-0738)\n","status":"published","published":"2017-10-11T12:01:33Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}