Read the docs
TI-2013-03628 Aliases CVE-2013-4155GHSA-wxx2-gqvv-34hx

OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to…

Priority LOW 22CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.

Why it matters now

EPSS 0.01675 76th percentileScored 2026-11-07
Fix Partial swift (PyPI): 1.9.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—swift (PyPI)before 1.9.11.9.1Patch availableGHSA-wxx2-gqvv-34hx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • swift (PyPI) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-wxx2-gqvv-34hx

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*not specified by NVDVulnerableOpenStack
cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*not specified by NVDVulnerableOpenStack
cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*not specified by NVDVulnerableOpenStack
cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*up to 1.9.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*1.1.0 rc1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*1.1.0 rc2VulnerableOpenStack
  • cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:* Versions up to 1.9.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:* Versions 1.1.0 rc1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:* Versions 1.1.0 rc2 Vulnerable ·OpenStack
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*1.2.0 gamma1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*1.2.0 rc1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*1.3.0 gamma1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*1.3.0 rc1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.8.0:rc1:*:*:*:*:*:*1.8.0 rc1VulnerableOpenStack
cpe:2.3:a:openstack:swift:1.8.0:rc2:*:*:*:*:*:*1.8.0 rc2VulnerableOpenStack
  • cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:* Versions 1.2.0 gamma1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:* Versions 1.2.0 rc1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:* Versions 1.3.0 gamma1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:* Versions 1.3.0 rc1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:* Versions 1.4.8 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.8.0:rc1:*:*:*:*:*:* Versions 1.8.0 rc1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:swift:1.8.0:rc2:*:*:*:*:*:* Versions 1.8.0 rc2 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-wxx2-gqvv-34hx swift (PyPI) Fixed in 1.9.1 Advisory →

Red Hat 1 advisory

  • RHSA-2013:1197 Released 2013-09-03 · Red Hat rating Moderate
    openstack-swift security update
    • Red Hat Enterprise Linux OpenStack Platform 3.0 openstack-swift-1.8.0-7.el6ost, openstack-swift-account-1.8.0-7.el6ost, openstack-swift-container-1.8.0-7.el6ost +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 4AffectedNo fix yet
Red Hat Enterprise Linux OpenStack Platform 3.0Fixed RHSA-2013:1197

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4155
  2. 2026-10-03 Alias added: GHSA-wxx2-gqvv-34hx

References

Advisory 4

Other 11

  • TI-2013-00195 Packstack: packstack: arbitrary file overwrite via symlink attack CVSS 3.1HIGH 8.8
  • TI-2013-01930 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and… CVSS 2.0HIGH 7.5
  • TI-2013-00265 Openstack nova: vnc proxy can connect to the wrong vm CVSS 3.1HIGH 7.6
  • TI-2013-01648 OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for… CVSS 2.0MEDIUM 6.8
  • TI-2013-00142 The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using… CVSS 2.0MEDIUM 6.5
  • TI-2013-03945 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2… CVSS 2.0MEDIUM 6.4
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences