USN-2256-1: Swift vulnerability
Ubuntu Security Notice USN-2256-1
25th June, 2014
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Swift did not properly perform input validation of certain HTTP headers.
- swift - OpenStack distributed virtual object store
John Dickinson discovered that Swift did not properly quote the
WWW-Authenticate header value. If a user were tricked into navigating to a
malicious Swift URL, an attacker could conduct cross-site scripting
attacks. With cross-site scripting vulnerabilities, if a user were tricked
into viewing server output during a crafted server request, a remote
attacker could exploit this to modify the contents, or steal confidential
data, within the same domain.
The problem can be corrected by updating your system to the following package version:
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.