CVE-2014-7960: openstack swift Resource Management Errors

EPSS trend

Probability

3.05%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.05% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

33 links

lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.htmlVendor AdvisoryX Refsource SUSEWEB
www.openwall.com/lists/oss-security/2014/10/08/7Mailing ListX Refsource MLISTWEB
bugs.launchpad.net/swift/+bug/1365350X Refsource CONFIRMVendor AdvisoryWEB
rhn.redhat.com/errata/RHSA-2015-1495.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2015-0835.htmlVendor AdvisoryX Refsource REDHATWEB
exchange.xforce.ibmcloud.com/vulnerabilities/96901VDB EntryX Refsource XFWEB
www.openwall.com/lists/oss-security/2014/10/07/39Mailing ListX Refsource MLISTWEB
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRMWEB
www.ubuntu.com/usn/USN-2704-1Vendor AdvisoryX Refsource UBUNTUWEB
www.securityfocus.com/bid/70279VDB EntryX Refsource BIDWEB

Show all 33 references

rhn.redhat.com/errata/RHSA-2015-0836.htmlVendor AdvisoryX Refsource REDHATWEB
nvd.nist.gov/vuln/detail/CVE-2014-7960Advisory
github.com/openstack/swift/commit/06800cbe446ce4c937a57b69517b55c3bba9b6e1WEB
github.com/openstack/swift/commit/2c4622a28ea04e1c6b2382189b0a1f6cccdc9c0fWEB
github.com/openstack/swift/commit/5b2c27a5874c2b5b0a333e4955b03544f6a8119fWEB
github.com/openstack/swiftPACKAGE
pypi.org/project/swiftPACKAGE
github.com/advisories/GHSA-g6x3-55qv-x6p2Advisory
access.redhat.com/errata/RHSA-2015:0835Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/site/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1150461REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0835.jsonAdvisory
access.redhat.com/security/cve/CVE-2014-7960REPORT
www.cve.org/CVERecord?id=CVE-2014-7960AdvisoryREPORT
access.redhat.com/errata/RHSA-2015:0836Advisory
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0836.jsonAdvisory
ubuntu.com/security/CVE-2014-7960REPORT
marc.info?l=oss-security&m=141275839830221&w=2REPORT
lists.openstack.org/pipermail/openstack-announce/2014-October/000291.htmlREPORT
rhn.redhat.com/errata/RHSA-2015-0836.htmlREPORT
ubuntu.com/security/notices/USN-2704-1Advisory
security-tracker.debian.org/tracker/CVE-2014-7960Advisory

Related vulnerabilities

CVE-2013-4155debianswift+111.68%13y ago20-08-2013 22:00OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.CVE-2013-6396debianpython-swiftclient+30.73%12y ago18-02-2014 19:00The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.CVE-2014-0006debianswift+91.91%12y ago23-01-2014 01:00The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.CVE-2014-3497debianswift+112.10%12y ago03-07-2014 17:00Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.CVE-2012-4406debianswift+146.57%13y ago22-10-2012 23:00OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.CVE-2026-71191debianswift+20.56%2mo ago05-08-2026 05:01In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target project_id, container name, and object name are known. This affects all deployments using the default s3_acl=false configuration.

All vulnerabilities inswift

CVE-2014-7960: openstack swift Resource Management Errors

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References