CVE-2022-47950 OpenStack Swift XML external entities (XXE) Injection
Authenticated users can read arbitrary files from the host server via crafted XML requests in the S3 API, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-47950?
CVE-2022-47950 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 18 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
Weakness: CWE-552
Which versions are affected by CVE-2022-47950?
7 open source packages ship an affected version, including swift. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
swift PyPI | All versions | 2.28.1, 2.29.2, 2.30.1 |
swift PyPI | All versions | 2.28.1 |
swift PyPI | All versions | 2.28.1 |
swift PyPI | From 2.29.0 | 2.29.2 |
swift PyPI | From 2.29.0 | 2.29.2 |
swift PyPI | From 2.30.0 | 2.30.1 |
1 more packages
swift PyPI | From 2.30.0 | 2.30.1 |
Linux distribution packages (22)
openstack-swift-plugin-swift3 Red Hat:openstack:13::el7 | All versions | 0:1.12.1-1.el7ost |
openstack-swift Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
openstack-swift-account Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
openstack-swift-container Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
openstack-swift-object Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
openstack-swift-proxy Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
python3-swift Red Hat:openstack:16.1::el8 | All versions | 0:2.23.2-1.20230201163512.eef87ee.el8ost |
openstack-swift Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
openstack-swift-account Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
openstack-swift-container Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
openstack-swift-object Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
openstack-swift-proxy Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
python3-swift Red Hat:openstack:16.2::el8 | All versions | 0:2.23.4-2.20220422185313.2829195.el8ost |
openstack-swift Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
openstack-swift-account Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
openstack-swift-container Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
openstack-swift-object Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
openstack-swift-proxy Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
python3-swift Red Hat:openstack:17.0::el9 | All versions | 0:2.27.1-0.20230201120900.6a1a8ce.el9ost |
python-swift3 SUSE:HPE Helion OpenStack 8 | All versions | 1.7.0.dev372-3.3.1 |
python-swift3 SUSE:OpenStack Cloud 8 | All versions | 1.7.0.dev372-3.3.1 |
python-swift3 SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.7.0.dev372-3.3.1 |
Products include Debian Debian Linux, Openstack Swift.
How do I fix CVE-2022-47950?
Upgrade swift to a fixed version for your release line: 2.28.1, 2.29.2 or 2.30.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-47950 being exploited?
There is no known exploitation of CVE-2022-47950 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-47950, DLA-3281-1, DSA-5327-1, GHSA-274c-rx2j-2v3x, PYSEC-2026-927, RHSA-2023:1013 and 4 more.