CVE-2012-4406

9.8 CRITICAL

Published: October 22, 2012 Modified: April 29, 2026

Description

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html

Source: secalert@redhat.com

Mailing List

http://rhn.redhat.com/errata/RHSA-2012-1379.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0691.html

Source: secalert@redhat.com

Not Applicable

http://www.openwall.com/lists/oss-security/2012/09/05/16

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2012/09/05/4

Source: secalert@redhat.com

Mailing List

http://www.securityfocus.com/bid/55420

Source: secalert@redhat.com

Broken Link

https://bugs.launchpad.net/swift/+bug/1006414

Source: secalert@redhat.com

Issue Tracking Patch

https://bugzilla.redhat.com/show_bug.cgi?id=854757

Source: secalert@redhat.com

Issue Tracking Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/79140

Source: secalert@redhat.com

Third Party Advisory VDB Entry

https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a

Source: secalert@redhat.com

Patch

https://launchpad.net/swift/+milestone/1.7.0

Source: secalert@redhat.com

Release Notes

http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html