Critical Remote Code Execution Vulnerability in OpenStack Swift Package
Summary
CVE-2012-4406: OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a cra... Affects swift versions < 1.4.8-2. Fixed in 1.4.8-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Swift is an open-source object storage system that allows users to store and retrieve data in a scalable and redundant manner. It is widely used in cloud computing environments to manage large amounts of unstructured data. The package is designed to be highly available and fault-tolerant, making it a popular choice for developers. However, prior to version 1.7.0, Swift had a significant vulnerability that could allow remote attackers to execute arbitrary code, compromising the integrity and security of the system.
Vulnerability Detail
The vulnerability, identified as CVE-2012-4406, arises from the unsafe use of the 'loads' function in the pickle Python module when storing and loading metadata in memcached. This flaw allows remote attackers to craft malicious pickle objects that, when processed by the vulnerable system, can execute arbitrary code. The implications of this vulnerability are severe, as it can lead to unauthorized access, data breaches, and complete system compromise. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
1.4.8-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade swiftTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of memcached for storing metadata until the package is updated. This can be done by modifying the configuration file to bypass memcached or by using an alternative storage method for metadata.
Conclusion
The CVE-2012-4406 vulnerability in OpenStack Swift poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, disabling memcached can serve as a temporary measure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for swift →
FAQ
CVE-2012-4406 is a critical vulnerability in OpenStack Swift that allows remote code execution through unsafe handling of pickle objects.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential complete system compromise.
Yes, upgrading to OpenStack Swift version 1.4.8-2 or later will patch this vulnerability.
If immediate upgrading is not possible, consider disabling memcached for metadata storage as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for swift.
