CVE-2015-5242: redhat gluster_storage Code Injection

Vulnerability summary

CVE-2015-5242 is a medium (CVSS 6.0) Code Injection vulnerability in redhat gluster_storage. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.

Timeline

1. 25-11-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.