Homepage

Improper Authentication Affecting swauth package, versions <1.2.0-4

Severity

 Recommended
0.0
critical
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.57% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN10-SWAUTH-271859
  • published21 Nov 2017
  • disclosed21 Nov 2017
Report a new vulnerability Found a mistake?

Introduced: 21 Nov 2017

CVE-2017-16613  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade Debian:10 swauth to version 1.2.0-4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream swauth package and not the swauth package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.