Description
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | swift | 2.2.0-2 | — |
| Debian 13 | swift | 2.2.0-2 | — |
| Debian 12 | swift | 2.2.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | swift | 1.13.1-0ubuntu1.2 | USN-2704-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | glusterfs +1 | 3.7.1-16.el7 | RHSA-2015:1846 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | openstack-swift +5 | 2.2.0-4.el7ost | RHSA-2015:1681 |
| Red Hat OpenStack 5 | openstack-swift +5 | 1.13.1-5.el7ost | RHSA-2015:1684 |
| Red Hat Gluster Storage 3 | gdeploy | 1.0-12.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | gluster-nagios-addons | 0.2.5-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | glusterfs +9 | 3.7.1-16.el6 | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | glusterfs-server +2 | 3.7.1-16.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | gstatus | 0.65-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | nagios-server-addons +1 | 0.2.2-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | nfs-ganesha +1 | 2.2.0-9.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | openstack-swift +5 | 1.13.1-6.el6ost | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | redhat-storage-server | 3.1.1.0-2.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | swiftonfile | 1.13.1-5.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | vdsm +14 | 4.16.20-1.3.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | openstack-swift +1 | 2.1.0-11.1 | SUSE-SU-2015:1846-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | swift | < 2.3.0 | 2.3.0 | GHSA-cc77-5vw4-7pwg |
Advisories 6
- RHSA-2015:1845 Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2015:1846 Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2015:1681 Red Hat Security Advisory: openstack-swift security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2015:1684 Red Hat Security Advisory: openstack-swift security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-2704-1 swift vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:1846-1 Security update for openstack-swift SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2015:1845 vendor-advisory
- https://bugs.launchpad.net/swift/+bug/1430645
- SUSE-SU-2015:1846 vendor-advisory
- RHSA-2015:1846 vendor-advisory
- RHSA-2015:1681 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- USN-2704-1 vendor-advisory
- 74182 vdb-entry
- FEDORA-2015-12245 vendor-advisory
- [openstack-announce] 20150414 [OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856) mailing-list
- RHSA-2015:1684 vendor-advisory