openstack-archive/swauth

openstack-archive/swauth

Releases10

Frequency8 months 3 weeks

Last Release over 8 years ago

Stars26

MOVED: now at https://opendev.org/x/swauth

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2017-16613 ↗	Nov 21, 2017Tuesday, 21 November 2017, 13:29	—	7.5 HIGH
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.