VulnerabilityModified
CVE-2012-4406
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
CRITICAL 9.8EPSS 6.57%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.57% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- openstack/swift · fedoraproject/fedora · redhat/gluster storage management console · redhat/gluster storage server for on-premise · redhat/storage · redhat/storage for public cloud · redhat/enterprise linux server
- Source
- secalert@redhat.com
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.htmlMailing List
- http://rhn.redhat.com/errata/RHSA-2012-1379.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0691.htmlNot Applicable
- http://www.openwall.com/lists/oss-security/2012/09/05/16Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/05/4Mailing List
- http://www.securityfocus.com/bid/55420Broken Link
- https://bugs.launchpad.net/swift/+bug/1006414Issue Tracking, Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=854757Issue Tracking, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79140Third Party Advisory, VDB Entry
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831aPatch
- https://launchpad.net/swift/+milestone/1.7.0Release Notes
- http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.htmlMailing List
- http://rhn.redhat.com/errata/RHSA-2012-1379.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0691.htmlNot Applicable
- http://www.openwall.com/lists/oss-security/2012/09/05/16Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/05/4Mailing List
- http://www.securityfocus.com/bid/55420Broken Link
- https://bugs.launchpad.net/swift/+bug/1006414Issue Tracking, Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=854757Issue Tracking, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79140Third Party Advisory, VDB Entry
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831aPatch
- https://launchpad.net/swift/+milestone/1.7.0Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.