CVE-2012-4406

critical

Description

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

References

Advisories
More

https://exchange.xforce.ibmcloud.com/vulnerabilities/79140

http://rhn.redhat.com/errata/RHSA-2012-1379.html

https://github.com/mrlegendary25/cve_hunter_gym

https://github.com/advisories/GHSA-v7mh-3jgf-r26c

https://launchpad.net/swift/+milestone/1.7.0

https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5311

https://bugzilla.redhat.com/show_bug.cgi?id=854757

https://bugs.launchpad.net/swift/+bug/1006414

http://www.securityfocus.com/bid/55420

http://www.openwall.com/lists/oss-security/2012/09/05/4

http://www.openwall.com/lists/oss-security/2012/09/05/16

http://rhn.redhat.com/errata/RHSA-2013-0691.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html

Details

Source: Mitre, NVD

Published: 2012-10-22

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.06571

Detections

Analytics