CVE-2012-4406

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-4406
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html Mailing List
http://rhn.redhat.com/errata/RHSA-2012-1379.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0691.html Not Applicable
http://www.openwall.com/lists/oss-security/2012/09/05/16 Mailing List
http://www.openwall.com/lists/oss-security/2012/09/05/4 Mailing List
http://www.securityfocus.com/bid/55420 Broken Link
https://bugs.launchpad.net/swift/+bug/1006414 Issue Tracking Patch
https://bugzilla.redhat.com/show_bug.cgi?id=854757 Issue Tracking Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 Third Party Advisory VDB Entry
https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a Patch
https://launchpad.net/swift/+milestone/1.7.0 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:redhat:gluster_storage_management_console:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
History

25 Jan 2024, 02:13

Type Values Removed Values Added
CPE cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:*		 cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_management_console:2.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
References () http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html - () http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html - Mailing List
References () http://rhn.redhat.com/errata/RHSA-2012-1379.html - () http://rhn.redhat.com/errata/RHSA-2012-1379.html - Third Party Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-0691.html - () http://rhn.redhat.com/errata/RHSA-2013-0691.html - Not Applicable
References () http://www.openwall.com/lists/oss-security/2012/09/05/16 - () http://www.openwall.com/lists/oss-security/2012/09/05/16 - Mailing List
References () http://www.openwall.com/lists/oss-security/2012/09/05/4 - () http://www.openwall.com/lists/oss-security/2012/09/05/4 - Mailing List
References () http://www.securityfocus.com/bid/55420 - () http://www.securityfocus.com/bid/55420 - Broken Link
References () https://bugs.launchpad.net/swift/+bug/1006414 - () https://bugs.launchpad.net/swift/+bug/1006414 - Issue Tracking, Patch
References () https://bugzilla.redhat.com/show_bug.cgi?id=854757 - () https://bugzilla.redhat.com/show_bug.cgi?id=854757 - Issue Tracking, Patch
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 - Third Party Advisory, VDB Entry
References () https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a - () https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a - Patch
References () https://launchpad.net/swift/+milestone/1.7.0 - () https://launchpad.net/swift/+milestone/1.7.0 - Release Notes
First Time Redhat storage For Public Cloud
Redhat
Redhat enterprise Linux Server
Redhat gluster Storage Server For On-premise
Fedoraproject fedora
Redhat gluster Storage Management Console
Fedoraproject
Redhat storage
CWE CWE-94 CWE-502
CVSS v2 : 7.5
v3 : unknown 		v2 : 7.5
v3 : 9.8

13 Feb 2023, 04:34

Type Values Removed Values Added
Summary CVE-2012-4406 Openstack-Swift: insecure use of python pickle() OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0691', 'name': 'https://access.redhat.com/errata/RHSA-2013:0691', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2012-4406', 'name': 'https://access.redhat.com/security/cve/CVE-2012-4406', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2012:1379', 'name': 'https://access.redhat.com/errata/RHSA-2012:1379', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 18:16

Type Values Removed Values Added
Summary OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object. CVE-2012-4406 Openstack-Swift: insecure use of python pickle()
References
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0691 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2012-4406 -
  • (MISC) https://access.redhat.com/errata/RHSA-2012:1379 -
Information

Published : 2012-10-22 23:55

Updated : 2024-01-25 02:13

NVD link : CVE-2012-4406

Mitre link : CVE-2012-4406

CVE.ORG link : CVE-2012-4406

JSON object : View

Products Affected

redhat

  • gluster_storage_management_console
  • storage_for_public_cloud
  • enterprise_linux_server
  • storage
  • gluster_storage_server_for_on-premise

fedoraproject

  • fedora

openstack

  • swift
CWE
CWE-502

Deserialization of Untrusted Data