CVE-2012-4406: OpenStack Object Storage (swift) Code Injection Vulnerability
Summary
CVE-2012-4406: OpenStack Object Storage (swift) Code Injection vulnerability. Affects swift versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
- swift · Debian:11
The same CVE-2012-4406 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Object Storage, commonly known as Swift, is a highly scalable object storage system designed for cloud environments. It allows users to store and retrieve large amounts of unstructured data. Swift is built to handle massive amounts of data with high availability and redundancy. However, prior to version 1.7.0, Swift had a critical vulnerability that could lead to code execution through unsafe handling of serialized data.
Vulnerability Detail
The vulnerability arises from the use of the 'loads' function in the pickle Python module, which is employed unsafely when storing and loading metadata in memcached. This flaw allows remote attackers to craft malicious pickle objects that, when processed by Swift, can execute arbitrary code on the server. The implications of this vulnerability are severe, as it could lead to unauthorized access, data manipulation, or complete system compromise.
How To Fix
Latest published version: 2.38.3 as of 22 Oct 2026
pip install --upgrade "swift==2.38.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.0
This is the first release that contains the fix.
pip install --upgrade "swift==1.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of memcached for storing metadata until the package can be updated. This can be done by modifying the configuration settings in your Swift deployment to avoid using memcached.
Conclusion
The CVE-2012-4406 vulnerability in OpenStack Object Storage (swift) poses a serious risk due to its potential for remote code execution. It is crucial for users to update to version 1.7.0 or later to protect their systems. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for swift →
FAQ
CVE-2012-4406 is a code injection vulnerability in OpenStack Object Storage (swift) that allows remote attackers to execute arbitrary code through crafted pickle objects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, or complete system compromise, posing a significant risk to affected systems.
Yes, the vulnerability is fixed in Swift version 1.7.0 and later. It is recommended to upgrade to this version or higher.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just the Pipfile.lock, ensuring your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for swift.
