CVE-2012-4406
Openstack-Swift: insecure use of python pickle()
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
OpenStack Object Storage (swift) antes de v1.7.0 utiliza la función loads en el módulo pickle de Python de forma no segura al almacenar y cargar los metadatos en memcached, lo que permite a atacantes remotos ejecutar código arbitrario a través de un objeto pickle modificado.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-08-21 CVE Reserved
- 2012-10-17 CVE Published
- 2024-05-22 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2012/09/05/16 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2012/09/05/4 | Mailing List |
|
| http://www.securityfocus.com/bid/55420 | Broken Link | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 | Third Party Advisory | |
| https://launchpad.net/swift/+milestone/1.7.0 | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugs.launchpad.net/swift/+bug/1006414 | 2024-01-25 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=854757 | 2013-03-28 | |
| https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a | 2024-01-25 |
| URL | Date | SRC |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html | 2024-01-25 | |
| http://rhn.redhat.com/errata/RHSA-2012-1379.html | 2024-01-25 | |
| http://rhn.redhat.com/errata/RHSA-2013-0691.html | 2024-01-25 | |
| https://access.redhat.com/security/cve/CVE-2012-4406 | 2013-03-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openstack Search vendor "Openstack" | Swift Search vendor "Openstack" for product "Swift" | < 1.7.0 Search vendor "Openstack" for product "Swift" and version " < 1.7.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 16 Search vendor "Fedoraproject" for product "Fedora" and version "16" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Gluster Storage Management Console Search vendor "Redhat" for product "Gluster Storage Management Console" | 2.0 Search vendor "Redhat" for product "Gluster Storage Management Console" and version "2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Gluster Storage Server For On-premise Search vendor "Redhat" for product "Gluster Storage Server For On-premise" | 2.0 Search vendor "Redhat" for product "Gluster Storage Server For On-premise" and version "2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Storage Search vendor "Redhat" for product "Storage" | 2.0 Search vendor "Redhat" for product "Storage" and version "2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Storage For Public Cloud Search vendor "Redhat" for product "Storage For Public Cloud" | 2.0 Search vendor "Redhat" for product "Storage For Public Cloud" and version "2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 5.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "5.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0" | - |
Affected
| ||||||