{
  "threat_severity" : "Important",
  "public_date" : "2012-05-30T00:00:00Z",
  "bugzilla" : {
    "description" : "Openstack-Swift: insecure use of python pickle()",
    "id" : "854757",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=854757"
  },
  "cvss" : {
    "cvss_base_score" : "7.5",
    "cvss_scoring_vector" : "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "status" : "verified"
  },
  "cwe" : "CWE-502",
  "details" : [ "OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object." ],
  "acknowledgement" : "Red Hat would like to thank Sebastian Krahmer (SUSE Security Team) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Native Client for RHEL 5 for Red Hat Storage",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2:client:el5",
    "package" : "glusterfs-0:3.3.0.7rhs-1.el5"
  }, {
    "product_name" : "Native Client for RHEL 6 for Red Hat Storage",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:3:client:el6",
    "package" : "glusterfs-0:3.3.0.7rhs-1.el6"
  }, {
    "product_name" : "OpenStack Essex for RHEL 6",
    "release_date" : "2012-10-16T00:00:00Z",
    "advisory" : "RHSA-2012:1379",
    "cpe" : "cpe:/a:redhat:openstack:1::el6",
    "package" : "openstack-swift-0:1.4.8-5.el6"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "appliance-0:1.7.1-1.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "augeas-0:0.9.0-1.el6"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "glusterfs-0:3.3.0.7rhs-1.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "gluster-swift-0:1.4.8-5.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "libvirt-0:0.9.10-21.el6_3.8"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "rhn-client-tools-0:1.0.0-73.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "sanlock-0:2.3-4.el6_3"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "sos-0:2.2-17.2.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:server:el6",
    "package" : "vdsm-0:4.9.6-20.el6rhs"
  }, {
    "product_name" : "Red Hat Storage 2.0 Console",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:console:el6",
    "package" : "org.ovirt.engine-root-0:2.0.techpreview1-4"
  }, {
    "product_name" : "Red Hat Storage 2.0 Console",
    "release_date" : "2013-03-28T00:00:00Z",
    "advisory" : "RHSA-2013:0691",
    "cpe" : "cpe:/a:redhat:storage:2.0:console:el6",
    "package" : "vdsm-0:4.9.6-20.el6rhs"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2012-4406\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-4406" ],
  "name" : "CVE-2012-4406",
  "csaw" : false
}