{"id":"CVE-2022-47950","aliases":["DEBIAN-CVE-2022-47950","DLA-3281-1","DSA-5327-1","EUVD-2023-0306","GHSA-274c-rx2j-2v3x","PYSEC-2026-927","RHSA-2023:1013","RHSA-2023:1277","SUSE-SU-2023:0323-1","SUSE-SU-2023:2378-1","UBUNTU-CVE-2022-47950","USN-5852-1"],"status":"published","title":"OpenStack Swift XML external entities (XXE) Injection","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01019,"percentile":0.63612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552","CWE-611"],"published":"2023-01-18T00:00:00Z","modified":"2026-11-03T08:03:57Z","fixes":[{"ecosystem":"PyPI","package":"swift","fixed_in":["2.28.1","2.29.2","2.30.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"swift","fixed_in":["2.30.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"swift","fixed_in":["2.30.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"swift","fixed_in":["2.30.0-4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"swift","fixed_in":["2.19.1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"swift","fixed_in":["2.26.0-10+deb11u1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-account","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-container","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-object","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-proxy","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-swift","fixed_in":["0:2.27.1-0.20230201120900.6a1a8ce.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"openstack-swift-plugin-swift3","fixed_in":["0:1.12.1-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-account","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-container","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-object","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-proxy","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-swift","fixed_in":["0:2.23.2-1.20230201163512.eef87ee.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-account","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-container","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-object","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-proxy","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-swift","fixed_in":["0:2.23.4-2.20220422185313.2829195.el8ost"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-swift3","fixed_in":["1.7.0.dev372-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-swift3","fixed_in":["1.7.0.dev372-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-swift3","fixed_in":["1.7.0.dev372-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"swift","fixed_in":["2.25.2-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"swift","fixed_in":["2.29.2-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.29.0"},{"fixed":"2.29.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.0"},{"last_affected":"2.30.0"},{"fixed":"2.30.1"}]}],"versions":["2.30.0"]},{"source":"osv","ecosystem":"Debian:12","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.1-1+deb10u1"}]}],"versions":["2.19.1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-10+deb11u1"}]}],"versions":["2.26.0-10"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.1"}]}],"versions":["1.0.2","2.15.2","2.17.1","2.19.1","2.19.2","2.20.0","2.21.0","2.21.1","2.22.0","2.23.0","2.23.1","2.23.2","2.23.3","2.24.0","2.25.0","2.25.1","2.25.2","2.26.0","2.27.0","2.28.0"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.29.0"},{"fixed":"2.29.2"}]}],"versions":["2.29.0","2.29.1"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.0"},{"fixed":"2.30.1"}]}],"versions":["2.30.0"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.1"},{"introduced":"2.29.0"},{"fixed":"2.29.2"},{"introduced":"2.30.0"},{"fixed":"2.30.1"}]}],"versions":["1.0.2","2.15.2","2.17.1","2.19.1","2.19.2","2.20.0","2.21.0","2.21.1","2.22.0","2.23.0","2.23.1","2.23.2","2.23.3","2.24.0","2.25.0","2.25.1","2.25.2","2.26.0","2.27.0","2.28.0","2.29.0","2.29.1","2.30.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.27.1-0.20230201120900.6a1a8ce.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"openstack-swift-plugin-swift3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.1-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.2-1.20230201163512.eef87ee.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-account","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-object","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-swift-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.23.4-2.20220422185313.2829195.el8ost"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-swift3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.dev372-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-swift3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.dev372-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-swift3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.dev372-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.24.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-3.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.42.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.41.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-2.36.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.24.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-3.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-0ubuntu1","2.7.0-0ubuntu2","2.7.0-0ubuntu2.1","2.7.1-0ubuntu1","2.7.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-0ubuntu1.1"}]}],"versions":["2.23.0-0ubuntu1","2.23.1-0ubuntu1","2.24.0~git2019121715.e890b0f0f-0ubuntu1","2.24.0-0ubuntu1","2.24.1~git2020032711.712bf3c9f-0ubuntu2","2.24.1~git2020041316.a495f1e32-0ubuntu1","2.25.0-0ubuntu0.20.04.1","2.25.1-0ubuntu1","2.25.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-0ubuntu1"}]}],"versions":["2.28.0+git2021090911.5d52afbe4-0ubuntu1","2.28.0+git2021120815.1859f2e16-0ubuntu1","2.28.0+git2021121320.876377435-0ubuntu1","2.28.0+git2022011309.32da73f5c-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu2","2.29.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-0ubuntu1.1"}]}],"versions":["2.23.0-0ubuntu1","2.23.1-0ubuntu1","2.24.0~git2019121715.e890b0f0f-0ubuntu1","2.24.0-0ubuntu1","2.24.1~git2020032711.712bf3c9f-0ubuntu2","2.24.1~git2020041316.a495f1e32-0ubuntu1","2.25.0-0ubuntu0.20.04.1","2.25.1-0ubuntu1","2.25.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-0ubuntu1"}]}],"versions":["2.28.0+git2021090911.5d52afbe4-0ubuntu1","2.28.0+git2021120815.1859f2e16-0ubuntu1","2.28.0+git2021121320.876377435-0ubuntu1","2.28.0+git2022011309.32da73f5c-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu2","2.29.1-0ubuntu1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openstack","product":"swift"}],"references":[{"url":"https://launchpad.net/bugs/1998625","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","web","article"]},{"url":"https://security.openstack.org/ossa/OSSA-2023-001.html","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2023/dsa-5327","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47950","tags":["advisory"]},{"url":"https://github.com/openstack/swift/commit/12e54391861e7d182d58f89fb88b027e65842640","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/7d13d1a82e1f5d01205a13184907501b4fcbe2b0","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/8dd96470a859dc7b189404fb67bd3899ae9c617f","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/b8467e190f6fc67fd8fb6a8c5e32b2aa6a10fd8e","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/baa98848451b5c234443a068691e12841a5a8383","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/c834e7a53d5a33a3fd13ffd954e6f4f4ee953dfc","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/d8d04ef43c90079d436b2e49617b4425ba39c28e","tags":["web"]},{"url":"https://github.com/openstack/swift/commit/f10672514217adadfc776d9ea2ffb20a37ce073b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-274c-rx2j-2v3x","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47950.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-47950","tags":["advisory"]},{"url":"https://github.com/openstack/swift","tags":["package"]},{"url":"https://pypi.org/project/swift","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1013","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160618","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1013.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-47950","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-47950","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1277","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1277.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207035","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47950","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232378-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208283","tags":["report"]},{"url":"https://bugzilla.suse.com/1209774","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25577","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-47950","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/01/17/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5852-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-47950","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T00:00:00Z","modified":"2025-04-04T15:48:20.285Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:34:24.971323Z"}],"euvd":[{"id":"EUVD-2023-0306","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T00:00:00Z","modified":"2025-04-04T15:48:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:42.420681Z"}],"ghsa":[{"id":"GHSA-274c-rx2j-2v3x","title":"OpenStack Swift XML external entities (XXE) Injection","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T18:30:16Z","modified":"2025-04-04T19:35:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552","CWE-611"],"updated_at":"2026-11-02T14:38:38.344711Z"}],"nvd":[{"id":"CVE-2022-47950","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T17:15:10.29Z","modified":"2026-06-17T05:14:30.62Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:07:35.157734Z"}],"osv":[{"id":"CVE-2022-47950","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T00:00:00Z","modified":"2026-10-28T02:30:42.78847626Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"DEBIAN-CVE-2022-47950","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T17:15:10.29Z","modified":"2026-11-03T08:03:57.039597608Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"GHSA-274c-rx2j-2v3x","title":"OpenStack Swift XML external entities (XXE) Injection","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T18:30:16Z","modified":"2026-07-07T11:56:33.587479612Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552","CWE-611"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"PYSEC-2026-927","title":"OpenStack Swift XML external entities (XXE) Injection","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2026-07-07T10:17:27.00112Z","modified":"2026-07-07T11:45:51.175050735Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2023:1013","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-swift) security update","status":"published","published":"2024-09-13T21:08:02Z","modified":"2026-08-01T10:03:17Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1277","title":"Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-swift) security update","status":"published","published":"2024-09-13T21:08:35Z","modified":"2026-08-01T10:03:19Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2022-47950","description":"An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).","status":"published","published":"2023-01-18T17:15:00Z","modified":"2026-02-04T03:15:36.493441Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DLA-3281-1","title":"swift - security update","status":"published","published":"2023-01-25T00:00:00Z","modified":"2026-03-09T01:20:57.126614Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5327-1","title":"swift - security update","status":"published","published":"2023-01-24T00:00:00Z","modified":"2026-03-09T02:09:48.179751Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"SUSE-SU-2023:0323-1","title":"Security update for python-swift3","description":"This update for python-swift3 fixes the following issues:\n\n- CVE-2022-47950: Fixed an issue that could allow a remote attacker to\n  disclose local file contents via a crafted XML file (bsc#1207035).\n","status":"published","published":"2023-02-08T16:08:10Z","modified":"2026-02-04T03:52:34.348997Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:2378-1","title":"Security update for openstack-heat, openstack-swift, python-Werkzeug","description":"This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes:\n\nSecurity fixes included in this update:\n\nopenstack-heat:\n- CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment (bsc#1209774).\n\nopenstack-swift:\n- CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035).\n\npython-Werkzeug:\n- CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283).\n\nNon security changes on this update:\n\nChanges in openstack-heat:\n- Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625)\n\nChanges in openstack-swift:\n- Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950)\n\nChanges in python-Werkzeug;\n- Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)\n  ","status":"published","published":"2023-06-05T14:38:36Z","modified":"2026-02-04T04:38:42.226506Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-5852-1","title":"swift vulnerability","description":"It was discovered that OpenStack Swift incorrectly handled certain XML\nfiles. A remote authenticated user could possibly use this issue to obtain\narbitrary file contents containing sensitive information from the server.\n","status":"published","published":"2023-02-09T17:21:29Z","modified":"2026-04-27T16:31:45.234666Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}