Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-4406

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

Published

2012-10-22T23:55:06.743

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	openstack	swift	< 1.7.0	Yes
Operating System	fedoraproject	fedora	16	Yes
Application	redhat	gluster_storage_management_console	2.0	Yes
Application	redhat	gluster_storage_server_for_on-premise	2.0	Yes
Application	redhat	storage	2.0	Yes
Application	redhat	storage_for_public_cloud	2.0	Yes
Operating System	redhat	enterprise_linux_server	5.0	Yes
Operating System	redhat	enterprise_linux_server	6.0	Yes

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html Mailing List ([email protected])
http://rhn.redhat.com/errata/RHSA-2012-1379.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2013-0691.html Not Applicable ([email protected])
http://www.openwall.com/lists/oss-security/2012/09/05/16 Mailing List ([email protected])
http://www.openwall.com/lists/oss-security/2012/09/05/4 Mailing List ([email protected])
http://www.securityfocus.com/bid/55420 Broken Link ([email protected])
https://bugs.launchpad.net/swift/+bug/1006414 Issue Tracking, Patch ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=854757 Issue Tracking, Patch ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 Third Party Advisory, VDB Entry ([email protected])
https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a Patch ([email protected])
https://launchpad.net/swift/+milestone/1.7.0 Release Notes ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2012-1379.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2013-0691.html Not Applicable (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2012/09/05/16 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2012/09/05/4 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/55420 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.launchpad.net/swift/+bug/1006414 Issue Tracking, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=854757 Issue Tracking, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a Patch (af854a3a-2127-422b-91ae-364da2661108)
https://launchpad.net/swift/+milestone/1.7.0 Release Notes (af854a3a-2127-422b-91ae-364da2661108)