GitHub Advisoryadvisory · PyPI
GHSA-v7mh-3jgf-r26c OpenStack Object Storage (swift) Code Injection vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2012-4406
- Ecosystem
- PyPI
- Packages
- swift
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502, CWE-94
- Reviewed
- 2023-02-08
Affected packages
• PyPI swift: < 1.7.0 → fixed in 1.7.0
Description
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
Related
Alias · CVE (1)
- CVE-2012-4406 OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-4406 advisory
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a web
- https://access.redhat.com/errata/RHSA-2012:1379 web
- https://access.redhat.com/errata/RHSA-2013:0691 web
- https://access.redhat.com/security/cve/CVE-2012-4406 web
- https://bugs.launchpad.net/swift/+bug/1006414 web
- https://bugzilla.redhat.com/show_bug.cgi?id=854757 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 web
- https://launchpad.net/swift/+milestone/1.7.0 web
- https://opendev.org/openstack/swift package
- https://web.archive.org/web/20130629092623/http://www.securityfocus.com/bid/55420 web
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html web
- http://rhn.redhat.com/errata/RHSA-2012-1379.html web
- http://rhn.redhat.com/errata/RHSA-2013-0691.html web
- http://www.openwall.com/lists/oss-security/2012/09/05/16 web
- http://www.openwall.com/lists/oss-security/2012/09/05/4 web
- http://www.securityfocus.com/bid/55420 web