Unauthorized delete of versioned Swift object

[Vitaly Sedelnik]

Clay Gerrard from SwiftStack reported a vulnerability in Swift object
versioning. An authenticated user can delete the most recent version of
any versioned object who's name is known if the user have listing access
to the x-versions-location container. Only Swift setups with
allow_version setting are affected.

See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/icehouse, stable/juno and master on the public
disclosure date.

CVE: CVE-2015-1856

Proposed public disclosure date/time:
2015-04-14, 1500UTC

[Alexey Khivin (akhivin)]

"Only Swift setups with allow_version setting are affected."
By default Fuel sets allow_version to false.

So, this vulnerability does not affect MOS deployments older then version 6.1
see
https://review.openstack.org/#/c/171965

[Alexey Khivin (akhivin)]

fix commited
https://review.fuel-infra.org/#/c/5665

[Timur Nurlygayanov (tnurlygayanov)]

Alexey Galkin, could you please verify the issue for MOS 6.1 and MOS 6.0 and change the status to Fix Released?

Thank you!

[Adam Heczko (aheczko-mirantis)]

Hello, is it fixed in MOS 6.1? If yes, which maintenance update?

[Vitaly Sedelnik (vsedelnik)]

Per Fix Released status and 6.1 milestone for 6.1.x this issue was fixed in MOS 6.1 GA.