Description
OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | swiftonfile | 1.13.1-6.el6rhs | RHSA-2015:1918 |
Advisories 1
- RHSA-2015:1918 Red Hat Security Advisory: swiftonfile security update Red Hat Security Advisories (RHSA) · Jun 27, 2026