National Cyber Awareness System

Vulnerability Summary for CVE-2012-4406

Overview

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://launchpad.net/swift/+milestone/1.7.0

Hyperlink:https://launchpad.net/swift/+milestone/1.7.0

External Source: CONFIRM

Name: https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a

Hyperlink:https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=854757

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=854757

External Source: CONFIRM

Name: https://bugs.launchpad.net/swift/+bug/1006414

Hyperlink:https://bugs.launchpad.net/swift/+bug/1006414

External Source: XF

Name: openstack-swift-loads-code-exec(79140)

Hyperlink:http://xforce.iss.net/xforce/xfdb/79140

External Source: BID

Name: 55420

Hyperlink:http://www.securityfocus.com/bid/55420

External Source: MLIST

Name: [oss-security] 20120905 CVE-Request: openstack pickle de-serialization

Hyperlink:http://www.openwall.com/lists/oss-security/2012/09/05/4

External Source: MLIST

Name: [oss-security] 20120905 Re: CVE-Request: openstack pickle de-serialization

Hyperlink:http://www.openwall.com/lists/oss-security/2012/09/05/16

External Source: REDHAT

Name: RHSA-2013:0691

Hyperlink:http://rhn.redhat.com/errata/RHSA-2013-0691.html

External Source: REDHAT

Name: RHSA-2012:1379

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-1379.html

External Source: FEDORA

Name: FEDORA-2012-15098

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html