Graphite is prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application. Impact Level: Application

Ask the Vendor for an update.

In graphite-web 0.9.5, a 'clustering' feature was introduced to allow for scaling for a graphite setup. This was achieved by passing pickles between servers. However due to no explicit safety measures having been implemented to limit the types of objects that can be unpickled, this creates a condition where arbitrary code can be executed

Graphite versions 0.9.5 through 0.9.10 are vulnerable.

Try to execute the 'sleep' command by sending a special crafted HTTP request and check how long the response take.

• http://www.securityfocus.com/bid/61894

---

Updated on 2015-03-25