Read the docs
TI-2015-01667 Aliases CVE-2015-1856GHSA-cc77-5vw4-7pwg

OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows…

Priority LOW 32CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
Partial Red Hat: 12 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.

Why it matters now

EPSS 0.04063 90th percentileScored 2026-11-07
Fix Partial swift (PyPI): 2.3.0Red Hat: 4 advisoriesRed Hat: 12 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—swift (PyPI)before 2.3.02.3.0Patch availableGHSA-cc77-5vw4-7pwg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • swift (PyPI) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-cc77-5vw4-7pwg

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*up to 2.2.2VulnerableOpenStack
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*15.04VulnerableCanonical
  • cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:* Versions up to 2.2.2 Vulnerable ·OpenStack
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* Versions 15.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-cc77-5vw4-7pwg swift (PyPI) Fixed in 2.3.0 Advisory →

Red Hat 4 advisories

  • RHSA-2015:1846 Released 2015-10-05 · Red Hat rating Moderate
    Red Hat Gluster Storage 3.1 update
    • Red Hat Gluster Storage NFS 3.1 on RHEL-7 nfs-ganesha-2.2.0-9.el7rhgs, nfs-ganesha-gluster-2.2.0-9.el7rhgs
    • Red Hat Gluster Storage Nagios 3.1 on RHEL-7 gluster-nagios-common-0.2.2-1.el7rhgs, nagios-server-addons-0.2.2-1.el7rhgs
    • Red Hat Gluster Storage Server 3.1 on RHEL-7 gdeploy-1.0-12.el7rhgs, gluster-nagios-addons-0.2.5-1.el7rhgs, gluster-nagios-common-0.2.2-1.el7rhgs +37
    • Red Hat Storage Native Client for Red Hat Enterprise Linux 7 glusterfs-3.7.1-16.el7, glusterfs-api-3.7.1-16.el7, glusterfs-api-devel-3.7.1-16.el7 +7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts glusterfs-3.7.1-16.el7, glusterfs-cli-3.7.1-16.el7
  • RHSA-2015:1845 Released 2015-10-05 · Red Hat rating Moderate
    Red Hat Gluster Storage 3.1 update
    • Red Hat Gluster Storage NFS 3.1 on RHEL-6 nfs-ganesha-2.2.0-9.el6rhs, nfs-ganesha-gluster-2.2.0-9.el6rhs
    • Red Hat Gluster Storage Nagios 3.1 on RHEL-6 gluster-nagios-common-0.2.2-1.el6rhs, nagios-server-addons-0.2.2-1.el6rhs
    • Red Hat Gluster Storage Server 3.1 on RHEL-6 gdeploy-1.0-12.el6rhs, gluster-nagios-addons-0.2.5-1.el6rhs, gluster-nagios-common-0.2.2-1.el6rhs +37
    • Red Hat Storage Native Client for Red Hat Enterprise Linux 6 glusterfs-3.7.1-16.el6, glusterfs-api-3.7.1-16.el6, glusterfs-api-devel-3.7.1-16.el6 +7
  • RHSA-2015:1684 Released 2015-08-25 · Red Hat rating Moderate
    openstack-swift security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-swift-1.13.1-6.el6ost, openstack-swift-account-1.13.1-6.el6ost, openstack-swift-container-1.13.1-6.el6ost +3
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-swift-1.13.1-5.el7ost, openstack-swift-account-1.13.1-5.el7ost, openstack-swift-container-1.13.1-5.el7ost +3
Show 1 more Red Hat advisories
  • RHSA-2015:1681 Released 2015-08-24 · Red Hat rating Moderate
    openstack-swift security update
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-swift-2.2.0-4.el7ost, openstack-swift-account-2.2.0-4.el7ost, openstack-swift-container-2.2.0-4.el7ost +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2015:1684
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:1684
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2015:1681
Red Hat Gluster Storage NFS 3.1 on RHEL-6Fixed RHSA-2015:1845
Red Hat Gluster Storage NFS 3.1 on RHEL-7Fixed RHSA-2015:1846
Red Hat Gluster Storage Nagios 3.1 on RHEL-6Fixed RHSA-2015:1845
Red Hat Gluster Storage Nagios 3.1 on RHEL-7Fixed RHSA-2015:1846
Red Hat Gluster Storage Server 3.1 on RHEL-6Fixed RHSA-2015:1845
Red Hat Gluster Storage Server 3.1 on RHEL-7Fixed RHSA-2015:1846
Red Hat Storage Native Client for Red Hat Enterprise Linux 6Fixed RHSA-2015:1845
Red Hat Storage Native Client for Red Hat Enterprise Linux 7Fixed RHSA-2015:1846
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2015:1846

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1856
  2. 2026-10-03 Alias added: GHSA-cc77-5vw4-7pwg

References

Advisory 10

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences