Unscored severity · published Jan 23, 2014
CVE-2014-0006
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an…
–
CVSS
1.9%
EPSS
No
On KEV
Description
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Swift · Openstack
1.4.6; 1.4.7; 1.4.8; 1.5.0; 1.6.0; 1.7.0; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0006
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0232.html
Patch
http://www.openwall.com/lists/oss-security/2014/01/17/5
Vendor Advisory
https://bugs.launchpad.net/swift/+bug/1265665
More from Swift
9.8
CVE-2017-16613
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1
9.8
CVE-2012-4406
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote…
8.7
CVE-2026-71190
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS)
7.5
CVE-2016-0738
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a…
7.5
CVE-2016-0737
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource…