CVE-2016-0738

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-0738
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176713.html
http://rhn.redhat.com/errata/RHSA-2016-0128.html
http://rhn.redhat.com/errata/RHSA-2016-0155.html
http://rhn.redhat.com/errata/RHSA-2016-0329.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/81432
https://bugs.launchpad.net/cloud-archive/+bug/1493303 Vendor Advisory
https://github.com/openstack/swift/blob/master/CHANGELOG Vendor Advisory
https://security.openstack.org/ossa/OSSA-2016-004.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:2.5.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:16

Type Values Removed Values Added
Summary A memory-leak issue was found in OpenStack Object Storage (swift), in the proxy-to-server connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption. OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0127', 'name': 'https://access.redhat.com/errata/RHSA-2016:0127', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0128', 'name': 'https://access.redhat.com/errata/RHSA-2016:0128', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0328', 'name': 'https://access.redhat.com/errata/RHSA-2016:0328', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0126', 'name': 'https://access.redhat.com/errata/RHSA-2016:0126', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-0738', 'name': 'https://access.redhat.com/security/cve/CVE-2016-0738', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0155', 'name': 'https://access.redhat.com/errata/RHSA-2016:0155', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1298905', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1298905', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0329', 'name': 'https://access.redhat.com/errata/RHSA-2016:0329', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 16:17

Type Values Removed Values Added
Summary OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL. A memory-leak issue was found in OpenStack Object Storage (swift), in the proxy-to-server connection. An OpenStack-authenticated attacker could remotely trigger this flaw to cause denial of service through excess memory consumption.
References
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0127 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0128 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0328 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0126 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-0738 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0155 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1298905 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0329 -
Information

Published : 2016-01-29 20:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-0738

Mitre link : CVE-2016-0738

CVE.ORG link : CVE-2016-0738

JSON object : View

Products Affected

openstack

  • swift
CWE
CWE-399

Resource Management Errors