Description
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | puppet-swift | puppet-swift 8.2.1, puppet-swift 9.4.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | puppet-module-swift | 9.4.4-1 | — |
| Debian 12 | puppet-module-swift | 9.4.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | puppet-module-swift | 9.4.4-1 | — |
| Ubuntu 16.04 LTS | puppet-module-swift | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | puppet-swift | 9.4.3-3.el7ost | RHSA-2017:0200 |
| Red Hat OpenStack 9 | openstack-puppet-modules | 1:8.1.10-2.el7ost | RHSA-2017:0359 |
| Red Hat OpenStack 8 | openstack-puppet-modules | 1:7.1.5-2.el7ost | RHSA-2017:0361 |
Advisories 3
- RHSA-2017:0361 Red Hat Security Advisory: openstack-puppet-modules security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:0359 Red Hat Security Advisory: openstack-puppet-modules security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:0200 Red Hat Security Advisory: puppet-swift security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
References
- RHSA-2017:0359 vendor-advisory
- 95448 vdb-entry
- RHSA-2017:0361 vendor-advisory
- RHSA-2017:0200 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9590