Description
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | swift | 1.4.8-2 | — |
| Debian 13 | swift | 1.4.8-2 | — |
| Debian 12 | swift | 1.4.8-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 1 | openstack-swift +5 | 1.4.8-5.el6 | RHSA-2012:1379 |
| Red Hat Gluster Storage 3 | glusterfs +3 | 3.3.0.7rhs-1.el6 | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | appliance +1 | 1.7.1-1.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | augeas +2 | 0.9.0-1.el6 | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | gluster-swift +5 | 1.4.8-5.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | glusterfs +3 | 3.3.0.7rhs-1.el5 | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | glusterfs-server +1 | 3.3.0.7rhs-1.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | libvirt +4 | 0.9.10-21.el6_3.8 | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | rhn-check +3 | 1.0.0-73.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | rhsc +11 | 2.0.techpreview1-4.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | sanlock +3 | 2.3-4.el6_3 | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | sos | 2.2-17.2.el6rhs | RHSA-2013:0691 |
| Red Hat Gluster Storage 2 | vdsm +8 | 4.9.6-20.el6rhs | RHSA-2013:0691 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | swift | < 1.7.0 | 1.7.0 | GHSA-v7mh-3jgf-r26c |
Advisories 2
- RHSA-2013:0691 Red Hat Security Advisory: Red Hat Storage 2.0 security, bug fix, and enhancement update #4 Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2012:1379 Red Hat Security Advisory: openstack-swift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- https://github.com/openstack/swift/commit/e1ff51c04554d51616d2845f92ab726cb0e5831a
- 55420 vdb-entry
- https://launchpad.net/swift/+milestone/1.7.0
- RHSA-2012:1379 vendor-advisory
- openstack-swift-loads-code-exec(79140) vdb-entry
- https://bugs.launchpad.net/swift/+bug/1006414
- https://bugzilla.redhat.com/show_bug.cgi?id=854757
- [oss-security] 20120905 CVE-Request: openstack pickle de-serialization mailing-list
- FEDORA-2012-15098 vendor-advisory
- RHSA-2013:0691 vendor-advisory
- [oss-security] 20120905 Re: CVE-Request: openstack pickle de-serialization mailing-list