CVE-2012-4406
Summary
| CVE | CVE-2012-4406 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-10-22 23:55:00 UTC |
| Updated | 2024-01-25 02:13:00 UTC |
| Description | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 16 | All | All | All |
| Application | Openstack | Swift | All | All | All | All |
| Application | Openstack | Swift | 1.0.0 | All | All | All |
| Application | Openstack | Swift | 1.0.1 | All | All | All |
| Application | Openstack | Swift | 1.0.2 | All | All | All |
| Application | Openstack | Swift | 1.1.0 | All | All | All |
| Application | Openstack | Swift | 1.1.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.1.0 | rc2 | All | All |
| Application | Openstack | Swift | 1.2.0 | All | All | All |
| Application | Openstack | Swift | 1.2.0 | gamma1 | All | All |
| Application | Openstack | Swift | 1.2.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.3.0 | All | All | All |
| Application | Openstack | Swift | 1.3.0 | gamma1 | All | All |
| Application | Openstack | Swift | 1.3.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.4.0 | All | All | All |
| Application | Openstack | Swift | 1.4.1 | All | All | All |
| Application | Openstack | Swift | 1.4.2 | All | All | All |
| Application | Openstack | Swift | 1.4.3 | All | All | All |
| Application | Openstack | Swift | 1.4.4 | All | All | All |
| Application | Openstack | Swift | 1.4.5 | All | All | All |
| Application | Openstack | Swift | 1.4.6 | All | All | All |
| Application | Openstack | Swift | 1.4.7 | All | All | All |
| Application | Openstack | Swift | 1.4.8 | All | All | All |
| Application | Openstack | Swift | 1.5.0 | All | All | All |
| Application | Openstack | Swift | 1.0.0 | All | All | All |
| Application | Openstack | Swift | 1.0.1 | All | All | All |
| Application | Openstack | Swift | 1.0.2 | All | All | All |
| Application | Openstack | Swift | 1.1.0 | All | All | All |
| Application | Openstack | Swift | 1.1.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.1.0 | rc2 | All | All |
| Application | Openstack | Swift | 1.2.0 | All | All | All |
| Application | Openstack | Swift | 1.2.0 | gamma1 | All | All |
| Application | Openstack | Swift | 1.2.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.3.0 | All | All | All |
| Application | Openstack | Swift | 1.3.0 | gamma1 | All | All |
| Application | Openstack | Swift | 1.3.0 | rc1 | All | All |
| Application | Openstack | Swift | 1.4.0 | All | All | All |
| Application | Openstack | Swift | 1.4.1 | All | All | All |
| Application | Openstack | Swift | 1.4.2 | All | All | All |
| Application | Openstack | Swift | 1.4.3 | All | All | All |
| Application | Openstack | Swift | 1.4.4 | All | All | All |
| Application | Openstack | Swift | 1.4.5 | All | All | All |
| Application | Openstack | Swift | 1.4.6 | All | All | All |
| Application | Openstack | Swift | 1.4.7 | All | All | All |
| Application | Openstack | Swift | 1.4.8 | All | All | All |
| Application | Openstack | Swift | 1.5.0 | All | All | All |
| Application | Openstack | Swift | All | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 6.0 | All | All | All |
| Application | Redhat | Gluster Storage Management Console | 2.0 | All | All | All |
| Application | Redhat | Gluster Storage Server For On-premise | 2.0 | All | All | All |
| Application | Redhat | Storage | 2.0 | All | All | All |
| Application | Redhat | Storage For Public Cloud | 2.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | MISC | access.redhat.com | |
| Do not use pickle for serialization in memcache, but JSON · openstack/swift@e1ff51c · GitHub | CONFIRM | github.com | |
| 1.7.0 : OpenStack Object Storage (swift) | CONFIRM | launchpad.net | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [SECURITY] Fedora 16 Update: openstack-swift-1.4.8-3.fc16 | FEDORA | lists.fedoraproject.org | |
| Bug #1006414 “Insecure loads()” : Bugs : OpenStack Object Storage (swift) | CONFIRM | bugs.launchpad.net | |
| Red Hat Customer Portal | MISC | access.redhat.com | |
| OpenStack Swift 'loads()' Arbitrary Code Execution Vulnerability | BID | www.securityfocus.com | |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | MISC | access.redhat.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| 854757 – (CVE-2012-4406) CVE-2012-4406 Openstack-Swift: insecure use of python pickle() | MISC | bugzilla.redhat.com | |
| oss-security - Re: CVE-Request: openstack pickle de-serialization | MLIST | www.openwall.com | |
| oss-security - CVE-Request: openstack pickle de-serialization | MLIST | www.openwall.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.