Pickle Security Flaw in Object Store

Issue

• Note that only users of Object Store (also known as gluster-swift or swiftonfile) are affected by the Pickle security flaw. Other Red Hat Gluster Storage users are unaffected.

• In older versions of gluster-swift (also known as swiftonfile), the metadata stored as xattrs of directories or files was serialized using PICKLE format. The PICKLE format is vulnerable to exploits in deployments where a user has access to the backend file system over FUSE or SMB. Deserializing pickled metadata can result in malicious code being executed if an attacker has stored malicious code as xattr from the file system interface.