OSSA-2015-006: Unauthorized delete of versioned Swift object¶
April 14, 2015
Swift: versions through 2.2.2
Clay Gerrard from SwiftStack reported a vulnerability in Swift object versioning. An authenticated user can delete the most recent version of any versioned object whose name is known if the user have listing access to the x-versions-location container. Only Swift setups with allow_version setting are affected.
Clay Gerrard from SwiftStack (CVE-2015-1856)
This fix will be included in the upcoming 2.3.0 release.