From 367a48bd7cbbd5ff942ce0f742b6b1ebecb08184 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 1 May 2024 11:26:35 +0000
Subject: [PATCH] Publish GHSA-qhq8-xwqv-pvv9

---
 .../GHSA-qhq8-xwqv-pvv9.json                  | 37 +++++++++++++++----
 1 file changed, 30 insertions(+), 7 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json (68%)

diff --git a/advisories/unreviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json b/advisories/github-reviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json
similarity index 68%
rename from advisories/unreviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json
rename to advisories/github-reviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json
index 34bc366e182..2836545b73b 100644
--- a/advisories/unreviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json
+++ b/advisories/github-reviewed/2022/05/GHSA-qhq8-xwqv-pvv9/GHSA-qhq8-xwqv-pvv9.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qhq8-xwqv-pvv9",
-  "modified": "2022-05-17T00:16:14Z",
+  "modified": "2024-05-01T11:24:02Z",
   "published": "2022-05-17T00:16:14Z",
   "aliases": [
     "CVE-2017-16613"
   ],
+  "summary": "OpenStack Swauth object/proxy server writing Auth Token to log file",
   "details": "An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allows attackers to bypass authentication by inserting a token into an X-Auth-Token header of a new request. NOTE: github.com/openstack/swauth URLs do not mean that Swauth is maintained by an official OpenStack project team.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "swauth"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.3.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -34,12 +53,16 @@
       "url": "https://bugs.launchpad.net/swift/+bug/1655781"
     },
     {
-      "type": "WEB",
-      "url": "https://www.debian.org/security/2017/dsa-4044"
+      "type": "PACKAGE",
+      "url": "https://github.com/openstack/swauth"
     },
     {
       "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/101926"
+      "url": "https://web.archive.org/web/20200227140059/http://www.securityfocus.com/bid/101926"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.debian.org/security/2017/dsa-4044"
     }
   ],
   "database_specific": {
@@ -47,8 +70,8 @@
       "CWE-287"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-01T11:24:02Z",
     "nvd_published_at": "2017-11-21T13:29:00Z"
   }
 }
\ No newline at end of file