CVE-2013-2161 OpenStack Swift Unchecked user input in XML responses
Attackers can inject XML via account names to spoof Swift responses, compromising data integrity and security in OpenStack Swift deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2161?
CVE-2013-2161 is a high-severity code injection vulnerability in Opensuse Opensuse, published on 20 Aug 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
Weakness: CWE-94
Which versions are affected by CVE-2013-2161?
3 open source packages ship an affected version, including swift. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
swift PyPI | All versions | 1.9.0 |
swift PyPI | All versions | 1.9.0 |
swift PyPI | All versions | 1.9.0 |
Linux distribution packages (6)
openstack-swift Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
openstack-swift-account Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
openstack-swift-container Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
openstack-swift-doc Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
openstack-swift-object Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
openstack-swift-proxy Red Hat:openstack:3::el6 | All versions | 0:1.8.0-6.el6ost |
Products include Openstack Folsom, Openstack Grizzly, Openstack Havana, Opensuse Opensuse.
How do I fix CVE-2013-2161?
Upgrade swift to 1.9.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2013-2161 being exploited?
There is no known exploitation of CVE-2013-2161 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
- CVE-2013-4497 OpenStack Compute Nova Improper Access Control
- CVE-2013-1665 XML External Entity (XXE) in Django
- CVE-2012-3447 Arbitrary file overwrite in OpenStack Nova
- CVE-2012-5625 OpenStack Nova Information leak in libvirt LVM-backed instances
- CVE-2013-4155 OpenStack Swift allows authenticated users to cause a denial of service
Sources
Also known as DEBIAN-CVE-2013-2161, GHSA-9xgv-6v35-mmcj, PYSEC-2026-930, RHSA-2013:0993.