CVE-2012-4406

CRITICAL

OpenStack Swift < 1.7.0 - Remote Code Execution via Unsafe Pickle Deserialization

Title source: llm
STIX 2.1

Description

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

References (11)

Core 11
Core References
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55420
Release Notes x_refsource_confirm
https://launchpad.net/swift/+milestone/1.7.0
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-1379.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79140
Issue Tracking, Patch x_refsource_confirm
https://bugs.launchpad.net/swift/+bug/1006414
Issue Tracking, Patch x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=854757
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/05/4
Not Applicable vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0691.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/05/16

Scores

CVSS v3 9.8
EPSS 0.0471
EPSS Percentile 89.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (9)
fedoraproject/fedora 16
openstack/swift < 1.7.0
pypi/swift 0 - 1.7.0PyPI
redhat/enterprise_linux_server 5.0
redhat/enterprise_linux_server 6.0
redhat/gluster_storage_management_console 2.0
redhat/gluster_storage_server_for_on-premise 2.0
redhat/storage 2.0
redhat/storage_for_public_cloud 2.0
Published Oct 22, 2012
Tracked Since Feb 18, 2026