CVEvulnerability
CVE-2012-4406
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2012-10-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
Affected configurations
• openstack swift (< 1.7.0)
• fedoraproject fedora 16
• redhat gluster storage management console 2.0
• redhat gluster storage server for on-premise 2.0
• redhat storage 2.0
• redhat storage for public cloud 2.0
• redhat enterprise linux server 5.0
• redhat enterprise linux server 6.0
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
Referenced by CWE · observed example (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html Mailing List
- http://rhn.redhat.com/errata/RHSA-2012-1379.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0691.html Not Applicable
- http://www.openwall.com/lists/oss-security/2012/09/05/16 Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/05/4 Mailing List
- http://www.securityfocus.com/bid/55420 Broken Link
- https://bugs.launchpad.net/swift/+bug/1006414 Issue Tracking, Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=854757 Issue Tracking, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 Third Party Advisory, VDB Entry
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a Patch
- https://launchpad.net/swift/+milestone/1.7.0 Release Notes
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html Mailing List
- http://rhn.redhat.com/errata/RHSA-2012-1379.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0691.html Not Applicable
- http://www.openwall.com/lists/oss-security/2012/09/05/16 Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/05/4 Mailing List
- http://www.securityfocus.com/bid/55420 Broken Link
- https://bugs.launchpad.net/swift/+bug/1006414 Issue Tracking, Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=854757 Issue Tracking, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 Third Party Advisory, VDB Entry
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a Patch
- https://launchpad.net/swift/+milestone/1.7.0 Release Notes