XML External Entity injection in Swift - CVE-2022-47950

Vulnerability identifier: #VU71237

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47950

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the S3 XML parser. A remote user can pass a specially crafted XML file to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Swift
Debian Linux
SUSE Linux Enterprise Server 12
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Ubuntu
Red Hat OpenStack for IBM Power
Red Hat OpenStack
python-Werkzeug
python-swift3
openstack-swift-plugin-swift3 (Red Hat package)
venv-openstack-swift-x86_64
python-swift
openstack-swift
openstack-swift-proxy
openstack-swift-account
openstack-swift-container
openstack-swift-object
openstack-swift (Red Hat package)
swift (Ubuntu package)
python3-swift (Ubuntu package)
swift (Debian package)
venv-openstack-octavia-x86_64
venv-openstack-designate-x86_64
venv-openstack-magnum-x86_64
venv-openstack-sahara-x86_64
openstack-heat-api
openstack-heat
openstack-heat-plugin-heat_docker
python-heat
openstack-heat-api-cfn
openstack-heat-engine
venv-openstack-heat-x86_64
venv-openstack-keystone-x86_64
IBM Storage Scale System

Install updates from vendor's website.

Swift - update to 2.29.2
python-Werkzeug - update to 0.14.1-3.6.2
python-swift3 - update to 1.7.0.dev372-3.3.1
openstack-swift-plugin-swift3 (Red Hat package) - update to 1.12.1-1.el7ost
venv-openstack-swift-x86_64 - update to 2.19.3~dev3-2.36.3
python-swift - update to 2.19.3~dev3-3.6.3
openstack-swift - update to 2.19.3~dev3-3.6.3
openstack-swift-proxy - update to 2.19.3~dev3-3.6.3
openstack-swift-account - update to 2.19.3~dev3-3.6.3
openstack-swift-container - update to 2.19.3~dev3-3.6.3
openstack-swift-object - update to 2.19.3~dev3-3.6.3
openstack-swift (Red Hat package) - addressed in versions 2.23.2-1.20230201163512.eef87ee.el8ost, 2.23.4-2.20220422185313.2829195.el8ost, 2.27.1-0.20230201120900.6a1a8ce.el9ost
swift (Ubuntu package) - addressed in versions 2.25.2-0ubuntu1.1, 2.29.2-0ubuntu1, 2.30.1-0ubuntu1
python3-swift (Ubuntu package) - addressed in versions 2.25.2-0ubuntu1.1, 2.29.2-0ubuntu1, 2.30.1-0ubuntu1
swift (Debian package) - update to 2.26.0-10+deb11u1
venv-openstack-octavia-x86_64 - update to 3.2.3~dev7-4.41.2
IBM Storage Scale System - addressed in versions 5.1.2.12, 5.1.8
venv-openstack-designate-x86_64 - update to 7.0.2~dev2-3.41.2
venv-openstack-magnum-x86_64 - update to 7.2.1~dev1-4.41.3
venv-openstack-sahara-x86_64 - update to 9.0.2~dev15-3.41.2
openstack-heat-api - update to 11.0.4~dev4-3.24.4
openstack-heat - update to 11.0.4~dev4-3.24.4
openstack-heat-plugin-heat_docker - update to 11.0.4~dev4-3.24.4
python-heat - update to 11.0.4~dev4-3.24.4
openstack-heat-api-cfn - update to 11.0.4~dev4-3.24.4
openstack-heat-engine - update to 11.0.4~dev4-3.24.4
venv-openstack-heat-x86_64 - update to 11.0.4~dev4-3.43.2
venv-openstack-keystone-x86_64 - update to 14.2.1~dev9-3.42.2

• https://security.openstack.org/ossa/OSSA-2023-001.html

• XXE in Openstack Swift
• Debian update for swift
• SUSE update for python-swift3
• Ubuntu update for swift
• XXE in Red Hat OpenStack Platform
• Red Hat OpenStack Platform update for openstack-swift
• SUSE update for openstack-heat, openstack-swift, python-Werkzeug
• XML external entity injection in IBM Storage Scale