PT-2012-5379 · Memcached+2 · Memcached+2

Krahmer + 1 · Published 2012-10-22 · Updated 2024-01-25 · CVE-2012-4406

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Object Storage (swift) versions prior to 1.7.0

Description The issue allows remote attackers to execute arbitrary code via a crafted pickle object. This is due to the unsafe use of the loads function in the pickle Python module when storing and loading metadata in memcached.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the memcached metadata storage to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

CVE-2012-4406

GHSA-V7MH-3JGF-R26C

RHSA-2012:1379

RHSA-2013:0691

Affected Products

Openstack Object Storage

Memcached

Pickle

References · 22

• https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a · Patch
• http://rhn.redhat.com/errata/RHSA-2012-1379.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0691.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4406 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v7mh-3jgf-r26c · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4406 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=854757 · Patch
• https://osv.dev/vulnerability/CVE-2012-4406 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4406 · Vendor Advisory
• https://bugs.launchpad.net/swift/+bug/1006414 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79140 · Note
• http://securityfocus.com/bid/55420 · Note
• https://access.redhat.com/security/cve/CVE-2012-4406 · Note
• http://openwall.com/lists/oss-security/2012/09/05/4 · Note