ID CVE-2012-4406
Summary OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
References
Vulnerable Configurations
  • cpe:2.3:a:openstack:swift:-:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:-:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openstack:swift:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:openstack:swift:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:gluster_storage_management_console:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:gluster_storage_management_console:2.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 25-01-2024 - 02:13)
Impact:
Exploitability:
CWE CWE-502
CAPEC
  • Object Injection
    An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2012:1379
  • rhsa
    id RHSA-2013:0691
rpms
  • openstack-swift-0:1.4.8-5.el6
  • openstack-swift-account-0:1.4.8-5.el6
  • openstack-swift-container-0:1.4.8-5.el6
  • openstack-swift-doc-0:1.4.8-5.el6
  • openstack-swift-object-0:1.4.8-5.el6
  • openstack-swift-proxy-0:1.4.8-5.el6
  • appliance-base-0:1.7.1-1.el6rhs
  • augeas-0:0.9.0-1.el6
  • augeas-debuginfo-0:0.9.0-1.el6
  • augeas-devel-0:0.9.0-1.el6
  • augeas-libs-0:0.9.0-1.el6
  • gluster-swift-0:1.4.8-5.el6rhs
  • gluster-swift-account-0:1.4.8-5.el6rhs
  • gluster-swift-container-0:1.4.8-5.el6rhs
  • gluster-swift-doc-0:1.4.8-5.el6rhs
  • gluster-swift-object-0:1.4.8-5.el6rhs
  • gluster-swift-proxy-0:1.4.8-5.el6rhs
  • glusterfs-0:3.3.0.7rhs-1.el5
  • glusterfs-0:3.3.0.7rhs-1.el6
  • glusterfs-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-debuginfo-0:3.3.0.7rhs-1.el5
  • glusterfs-debuginfo-0:3.3.0.7rhs-1.el6
  • glusterfs-debuginfo-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-devel-0:3.3.0.7rhs-1.el5
  • glusterfs-devel-0:3.3.0.7rhs-1.el6
  • glusterfs-devel-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-fuse-0:3.3.0.7rhs-1.el5
  • glusterfs-fuse-0:3.3.0.7rhs-1.el6
  • glusterfs-fuse-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-geo-replication-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-rdma-0:3.3.0.7rhs-1.el5
  • glusterfs-rdma-0:3.3.0.7rhs-1.el6
  • glusterfs-rdma-0:3.3.0.7rhs-1.el6rhs
  • glusterfs-server-0:3.3.0.7rhs-1.el6rhs
  • libvirt-0:0.9.10-21.el6_3.8
  • libvirt-client-0:0.9.10-21.el6_3.8
  • libvirt-debuginfo-0:0.9.10-21.el6_3.8
  • libvirt-devel-0:0.9.10-21.el6_3.8
  • libvirt-lock-sanlock-0:0.9.10-21.el6_3.8
  • libvirt-python-0:0.9.10-21.el6_3.8
  • rhn-check-0:1.0.0-73.el6rhs
  • rhn-client-tools-0:1.0.0-73.el6rhs
  • rhn-setup-0:1.0.0-73.el6rhs
  • rhn-setup-gnome-0:1.0.0-73.el6rhs
  • rhsc-0:2.0.techpreview1-4.el6rhs
  • rhsc-backend-0:2.0.techpreview1-4.el6rhs
  • rhsc-config-0:2.0.techpreview1-4.el6rhs
  • rhsc-dbscripts-0:2.0.techpreview1-4.el6rhs
  • rhsc-genericapi-0:2.0.techpreview1-4.el6rhs
  • rhsc-jboss-deps-0:2.0.techpreview1-4.el6rhs
  • rhsc-notification-service-0:2.0.techpreview1-4.el6rhs
  • rhsc-restapi-0:2.0.techpreview1-4.el6rhs
  • rhsc-setup-0:2.0.techpreview1-4.el6rhs
  • rhsc-tools-common-0:2.0.techpreview1-4.el6rhs
  • rhsc-userportal-0:2.0.techpreview1-4.el6rhs
  • rhsc-webadmin-portal-0:2.0.techpreview1-4.el6rhs
  • sanlock-0:2.3-4.el6_3
  • sanlock-debuginfo-0:2.3-4.el6_3
  • sanlock-devel-0:2.3-4.el6_3
  • sanlock-lib-0:2.3-4.el6_3
  • sanlock-python-0:2.3-4.el6_3
  • sos-0:2.2-17.2.el6rhs
  • vdsm-0:4.9.6-20.el6rhs
  • vdsm-bootstrap-0:4.9.6-20.el6rhs
  • vdsm-cli-0:4.9.6-20.el6rhs
  • vdsm-debug-plugin-0:4.9.6-20.el6rhs
  • vdsm-debuginfo-0:4.9.6-20.el6rhs
  • vdsm-gluster-0:4.9.6-20.el6rhs
  • vdsm-hook-faqemu-0:4.9.6-20.el6rhs
  • vdsm-hook-vhostmd-0:4.9.6-20.el6rhs
  • vdsm-python-0:4.9.6-20.el6rhs
  • vdsm-reg-0:4.9.6-20.el6rhs
refmap via4
bid 55420
confirm
fedora FEDORA-2012-15098
misc https://bugzilla.redhat.com/show_bug.cgi?id=854757
mlist
  • [oss-security] 20120905 CVE-Request: openstack pickle de-serialization
  • [oss-security] 20120905 Re: CVE-Request: openstack pickle de-serialization
xf openstack-swift-loads-code-exec(79140)
Last major update 25-01-2024 - 02:13
Published 22-10-2012 - 23:55
Last modified 25-01-2024 - 02:13
Back to Top