CVE-2012-4406: OpenStack Object Storage (swift) Code Injection vulnerability
Summary
CVE-2012-4406: OpenStack Object Storage (swift) Code Injection vulnerability. Affects swift versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
- swift · Debian:11
The same CVE-2012-4406 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Object Storage (swift) is a scalable and highly available distributed object storage system. It provides a simple and flexible storage solution for storing and retrieving large amounts of unstructured data. Swift is widely used in cloud computing environments to store and manage data. However, prior to version 1.7.0, Swift was vulnerable to a code injection vulnerability.
Vulnerability Detail
The vulnerability in OpenStack Object Storage (swift) arises from the unsafe usage of the loads function in the pickle Python module when storing and loading metadata in memcached. This allows remote attackers to execute arbitrary code by crafting a malicious pickle object. An attacker could exploit this vulnerability to gain unauthorized access, modify data, or execute arbitrary commands on the affected system. The vulnerability has a high severity rating (CWE-94) and was published on May 17, 2022.
How To Fix
Latest published version: 2.38.3 as of 22 Oct 2026
pip install --upgrade "swift==2.38.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.0
This is the first release that contains the fix.
pip install --upgrade "swift==1.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a secure version of OpenStack Object Storage (swift).
Conclusion
The code injection vulnerability in OpenStack Object Storage (swift) poses a significant risk to the security and integrity of affected systems. It is crucial to upgrade to version 1.7.0 or later to mitigate this vulnerability. Failure to apply the recommended fix could result in unauthorized access, data manipulation, and arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for swift →
FAQ
OpenStack Object Storage (swift) is a distributed object storage system designed to store and retrieve large amounts of unstructured data. It provides scalability, high availability, and durability for cloud-based storage solutions.
A code injection vulnerability occurs when an attacker is able to insert and execute malicious code within an application or system. In the case of OpenStack Object Storage (swift), the vulnerability allows remote attackers to execute arbitrary code by crafting a malicious pickle object.
The code injection vulnerability in OpenStack Object Storage (swift) could allow attackers to gain unauthorized access to the system, modify data, or execute arbitrary commands. This can lead to data breaches, system compromise, and unauthorized actions on the affected system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file to assess the vulnerability status.
For further information and support on vulnerability remediation, you can contact info@devnack.com. They can provide additional guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for swift.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
