PT-2012-5379 · Python+2 · Pickle+2

Krahmer + 1 · CVE-2012-4406 · Published 2012-10-22 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Object Storage (swift) versions prior to 1.7.0

Description The issue allows remote attackers to execute arbitrary code via a crafted pickle object. This is due to the unsafe use of the loads function in the pickle Python module when storing and loading metadata in memcached.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the memcached metadata storage to minimize the risk of exploitation.

Fix

DoS

RCE

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

CVE-2012-4406

GHSA-V7MH-3JGF-R26C

PYSEC-2026-545

RHSA-2012:1379

RHSA-2013:0691

Affected Products

Openstack Object Storage

Memcached

Pickle

References · 25

• https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a · Patch
• https://bugs.launchpad.net/swift/+bug/1006414 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=854757 · Patch
• http://rhn.redhat.com/errata/RHSA-2012-1379.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0691.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4406 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089472.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4406 · Security Note
• https://osv.dev/vulnerability/GHSA-v7mh-3jgf-r26c · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4406 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4406 · Vendor Advisory
• https://pypi.org/project/swift · Note
• https://access.redhat.com/security/cve/CVE-2012-4406 · Note
• http://openwall.com/lists/oss-security/2012/09/05/4 · Note