OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.07793
Percentile: 0.91536

CVSS Scoring

Mapped CWE(s)

• CWE-502 : Deserialization of Untrusted Data

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

Affected Products

• cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:gluster_storage_management_console:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

← Back to Home