Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 17 Jan 2023 16:01:11 +0000
From: Jeremy Stanley <>
Subject: [OSSA-2023-001] Swift: Arbitrary file access through custom S3 XML
 entities (CVE-2022-47950)

OSSA-2023-001: Arbitrary file access through custom S3 XML entities

:Date: January 17, 2023
:CVE: CVE-2022-47950

- Swift: <2.28.1, >=2.29.0 <2.29.2, ==2.30.0

S├ębastien Meriot (OVH) reported a vulnerability in Swift's S3 XML
parser. By supplying specially crafted XML files an authenticated user
may coerce the S3 API into returning arbitrary file contents from the
host server resulting in unauthorized read access to potentially
sensitive data; this impacts both s3api deployments (Rocky or later),
and swift3 deployments (Queens and earlier, no longer actively
developed). Only deployments with S3 compatibility enabled are

- (2023.1/antelope)
- (Wallaby)
- (Xena)
- (Yoga)
- (Zed)

- S├ębastien Meriot from OVH (CVE-2022-47950)


- The stable/wallaby branch is under extended maintenance and will receive no
  new point releases, but a patch for it is provided as a courtesy.

Jeremy Stanley
OpenStack Vulnerability Management Team

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.