Your message dated Mon, 23 May 2016 19:32:18 +0000
with message-id <[email protected]>
and subject line Bug#822688: fixed in swift-plugin-s3 1.7-5+deb8u1
has caused the Debian Bug report #822688,
regarding CVE-2015-8466: replay attack - date/date header unvalidated
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
822688: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822688
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: swift-plugin-s3
Version: 1.7-5
Severity: normal
Tags: security
https://review.openstack.org/#/c/255067/6
Fix date validation
According to [1] when an Authorization header is specified, either a
Date or x-amz-date header needs to be specified, with the x-amz-date
header taking precedence.
Now, the x-amz-date header is validated first, and if both headers are
missing, an AccessDenied error should be returned. This should prevent
replay attacks occurring on valid requests that are missing the Date
header.
-- System Information:
Debian Release: stretch/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.5.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
Source: swift-plugin-s3
Source-Version: 1.7-5+deb8u1
We believe that the bug you reported is fixed in the latest version of
swift-plugin-s3, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ondřej Nový <[email protected]> (supplier of updated swift-plugin-s3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 26 Apr 2016 17:21:19 +0200
Source: swift-plugin-s3
Binary: swift-plugin-s3
Architecture: source all
Version: 1.7-5+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: PKG OpenStack <[email protected]>
Changed-By: Ondřej Nový <[email protected]>
Description:
swift-plugin-s3 - swift3 (S3 compatibility) middleware plugin for swift
Closes: 822688
Changes:
swift-plugin-s3 (1.7-5+deb8u1) jessie-security; urgency=high
.
* CVE-2015-8466: replay attack - date/date header unvalidated
(Closes: #822688)
Checksums-Sha1:
9737ca9245bbe7c92d9f78a89564b97740e40704 2263 swift-plugin-s3_1.7-5+deb8u1.dsc
057aa347136fd027400994ecc37a44f981edcd01 17472 swift-plugin-s3_1.7.orig.tar.xz
e9b0b0b0a5a5587e7a300cec0054bfdbb12b2eed 4904
swift-plugin-s3_1.7-5+deb8u1.debian.tar.xz
e1fe3cf1f9ce891abf6055624bc7523516fbe5ce 26852
swift-plugin-s3_1.7-5+deb8u1_all.deb
Checksums-Sha256:
fb508d50245ff6d96200cf278235756f75ba120bb1a70192c120e70a859987d7 2263
swift-plugin-s3_1.7-5+deb8u1.dsc
2754129cd3f01e79203b89472ecb4ba7b3cf3c27ade49c30c60675b647dcbd14 17472
swift-plugin-s3_1.7.orig.tar.xz
bf515dc95c270c44c1665bc1a7721dad867ac43cc5acbb91935c118787121810 4904
swift-plugin-s3_1.7-5+deb8u1.debian.tar.xz
9fa29d23f2a1a2c130d77ba94a24f86fcaeeb77ac465869b173fb24d278a476e 26852
swift-plugin-s3_1.7-5+deb8u1_all.deb
Files:
1b8b84eba8e0308ddccb28bfaa0b23fa 2263 python extra
swift-plugin-s3_1.7-5+deb8u1.dsc
5e2602b1568218304a5f146774acea15 17472 python extra
swift-plugin-s3_1.7.orig.tar.xz
b88ee93b07f8b7776cb92e652e1c5e41 4904 python extra
swift-plugin-s3_1.7-5+deb8u1.debian.tar.xz
4b6125dd040703e8657b6414980cb4ea 26852 python extra
swift-plugin-s3_1.7-5+deb8u1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJXPHnvAAoJENQWrRWsa0P+oxsP/R4ko/N7dT0TTQ9UlCf8Sdfx
gFoI85rBDrDgz/+4cSkN/khxat8WXWMakEYskqk42MESN2Wq3LUK+C+KAX9txLRk
jluimi3QmhizFyblYRWdHp3Es5FBvDwct9taNs9rSSSs8B0v8aeeaU56lIXEgkA4
IeWrPbWeGQm1LnDLwPDQ8O95yAH72+e73g2RR8eTBHXiQ4NO4IcznaHyr12u71OL
mTOKUlJuQqHL7nyrWXhO11d2KDusLCcrS1aahCr7agQM4cAN6gSWtfxPSeXAHchx
BifkFzWgYz6Ph2l3zopTjTfqK4CGCZsGuQr42TzHn/npZhR11YwPhJS7xjWgnkiN
6rioEyRXA/gsmv22ZP5INECq3E04ffWiZ5P3a1/loxszY9eQ4QNEOjwo7H5ev2ze
dH8v7+dJ80DXGFyHhVYlVuMDKCYxZq2l4aKZorX2kzs1vv2hUOC/UMa4TJtfBlvB
sV5BTEU79X2wqIp+joTj5awwfWCCFXptob6Iwl45WGSUMvgGzf9rmKQ768MKWddX
YWTGgrFLbTxWc17aLW20aZdFaaeD06hqYbLgPCFYPiUKB7/hWT/VIhjGOT092WIs
5TcOpMfLC8HIbQMM+SqWNlMJmcBay3owdYsHG/RFumVt7SEAqYuoup+x6kUxGGlC
1i1p5nWKNtm9e3qgnJ5u
=1yHG
-----END PGP SIGNATURE-----
--- End Message ---
