CVE-2014-7960 — OpenStack Swift metadata constraints are not correctly enforced

Description

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	swift	2.2.0-1	—
Debian 13	swift	2.2.0-1	—
Debian 12	swift	2.2.0-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 14.04 LTS	swift	1.13.1-0ubuntu1.2	USN-2704-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenStack 5	openstack-swift +5	1.13.1-4.el6ost	RHSA-2015:0836, RHSA-2015:0835
Red Hat Gluster Storage 3	augeas +2	1.0.0-10.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	ccs +1	0.16.2-81.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	check-mk +1	1.2.6p1-3.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	clufter +5	0.11.2-1.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	clustermon +3	0.16.2-31.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	cman +4	3.0.12.1-73.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	corosync +2	1.4.7-2.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	ctdb2.5	2.5.5-7.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	fence-virt +5	0.2.3-19.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	gluster-nagios-addons	0.2.4-4.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	gluster-nagios-common	0.2.0-1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	glusterfs +9	3.7.1-11.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	glusterfs-server +2	3.7.1-11.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	gstatus	0.64-3.1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	libqb +1	0.17.1-1.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	libvirt-lock-sanlock	0.10.2-54.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	nagios-plugins +4	1.4.16-12.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	nagios-server-addons	0.2.1-4.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	nfs-ganesha +2	2.2.0-5.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	nrpe +1	2.15-4.1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	openais +2	1.1.1-7.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	openstack-swift +5	1.13.1-4.el6ost	RHSA-2015:1495
Red Hat Gluster Storage 3	pacemaker +7	1.1.12-8.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	pcs	0.9.139-9.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	pnp4nagios	0.6.22-2.1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	pynag +1	0.9.1-1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	pytalloc +3	2.1.1-4.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	python-blivet	1:1.0.0.2-1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	python-cpopen	1.3-4.el6_5	RHSA-2015:1495
Red Hat Gluster Storage 3	python-eventlet +1	0.14.0-1.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	python-greenlet +1	0.4.2-1.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	python-keystoneclient +1	1:0.9.0-5.el6ost	RHSA-2015:1495
Red Hat Gluster Storage 3	python-prettytable	0.7.2-1.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	python-pyudev	0.15-2.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	redhat-storage-logos	60.0.20-1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	redhat-storage-server	3.1.0.3-1.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	resource-agents +1	3.9.5-24.el6	RHSA-2015:1495
Red Hat Gluster Storage 3	userspace-rcu +1	0.7.9-2.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 3	vdsm +14	4.16.20-1.2.el6rhs	RHSA-2015:1495
Red Hat Gluster Storage 2	glusterfs +9	3.7.1-11.el5	RHSA-2015:1495

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SUSE OpenStack Cloud 5	openstack-swift +1	2.1.0-11.1	SUSE-SU-2015:1846-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	swift	< 2.2.0	2.2.0	GHSA-g6x3-55qv-x6p2

Advisories 5

RHSA-2015:0835 Red Hat Security Advisory: openstack-swift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
RHSA-2015:1495 Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update Red Hat Security Advisories (RHSA) · Aug 8, 2026
RHSA-2015:0836 Red Hat Security Advisory: openstack-swift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
USN-2704-1 swift vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
SUSE-SU-2015:1846-1 Security update for openstack-swift SUSE / openSUSE Security Updates · Feb 4, 2026

References

SUSE-SU-2015:1846 vendor-advisory
[oss-security] 20141008 Re: CVE request for vulnerability in OpenStack Swift mailing-list
https://bugs.launchpad.net/swift/+bug/1365350
RHSA-2015:1495 vendor-advisory
RHSA-2015:0835 vendor-advisory
openstack-swift-cve20147960-sec-bypass(96901) vdb-entry
[oss-security] 20141007 CVE request for vulnerability in OpenStack Swift mailing-list
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
USN-2704-1 vendor-advisory
70279 vdb-entry
RHSA-2015:0836 vendor-advisory