Description
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | swift | 2.30.0-4 | — |
| Debian 13 | swift | 2.30.0-4 | — |
| Debian 12 | swift | 2.30.0-4 | — |
| Debian 11 | swift | 2.26.0-10+deb11u1 | DSA-5327-1 |
| Debian 10 | swift | 2.19.1-1+deb10u1 | DLA-3281-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | swift | 2.29.2-0ubuntu1 | USN-5852-1 |
| Ubuntu 20.04 LTS | swift | 2.25.2-0ubuntu1.1 | USN-5852-1 |
| Ubuntu 16.04 LTS | swift | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | python3-swift +5 | 2.27.1-0.20230201120900.6a1a8ce.el9ost | RHSA-2023:1013 |
| Red Hat OpenStack 16 | python3-swift +5 | 2.23.2-1.20230201163512.eef87ee.el8ost | RHSA-2023:1277 |
| Red Hat OpenStack 13 | openstack-swift-plugin-swift3 | 1.12.1-1.el7ost | RHSA-2023:1277 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat | 11.0.4~dev4-3.24.4 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-swift | 2.19.3~dev3-3.6.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Werkzeug | 0.14.1-3.6.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-swift3 | 1.7.0.dev372-3.3.1 | SUSE-SU-2023:0323-1 |
| SUSE OpenStack Cloud 9 | openstack-heat | 11.0.4~dev4-3.24.4 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | openstack-swift | 2.19.3~dev3-3.6.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | python-Werkzeug | 0.14.1-3.6.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.43.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.42.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.41.3 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.41.2 | SUSE-SU-2023:2378-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.3~dev3-2.36.3 | SUSE-SU-2023:2378-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 8 | python-swift3 | 1.7.0.dev372-3.3.1 | SUSE-SU-2023:0323-1 |
| SUSE HPE Helion OpenStack 8 | python-swift3 | 1.7.0.dev372-3.3.1 | SUSE-SU-2023:0323-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | swift | < 2.28.1 | 2.28.1 | GHSA-274c-rx2j-2v3x |
| PyPI | swift | >= 2.29.0, < 2.29.2 | 2.29.2 | GHSA-274c-rx2j-2v3x |
| PyPI | swift | >= 2.30.0, < 2.30.1 | 2.30.1 | GHSA-274c-rx2j-2v3x |
| PyPI | swift | < 2.28.1 · >= 2.29.0, < 2.29.2 · >= 2.30.0, < 2.30.1 | 2.28.1, 2.29.2, 2.30.1 | PYSEC-2026-927 |
Advisories 8
- RHSA-2023:1277 Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-swift) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2023:1013 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-swift) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-5852-1 swift vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5327-1 swift - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3281-1 swift - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:2378-1 Security update for openstack-heat, openstack-swift, python-Werkzeug SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0323-1 Security update for python-swift3 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0518 Red Hat OpenStack: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 10, 2025