PT-2006-5469 · Zope+1 · Zope2+1

Jim Fulton · Publicado 2006-09-19 · Atualizado 2022-05-01 · CVE-2006-4684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zope2 versions 2.7.0 through 2.7.9 Zope2 versions 2.8.0 through 2.8.8

Description The issue is related to the docutils module in Zope2, which does not properly handle web pages with reStructuredText (reST) markup. This allows remote attackers to read arbitrary files via a csv table directive.

Recommendations For Zope2 versions 2.7.0 through 2.7.9, update to a version that properly handles reST markup to prevent exploitation. For Zope2 versions 2.8.0 through 2.8.8, update to a version that properly handles reST markup to prevent exploitation. As a temporary workaround, consider disabling the csv table directive in the docutils module until a patch is available.

Correção

Identificadores relacionados

CVE-2006-4684

DSA-1176-1

GHSA-HM8G-JXJJ-GFM3

PYSEC-2006-8

Produtos afetados

Zope2

Docutils

Referências · 13

• https://github.com/zopefoundation/Zope · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-8.yaml · Nota
• http://secunia.com/advisories/21947 · Aviso do Fabricante
• http://zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt · Correção
• http://mail.zope.org/pipermail/zope-announce/2006-August/002005.html · Nota
• http://vupen.com/english/advisories/2006/3653 · Nota
• https://osv.dev/vulnerability/PYSEC-2006-8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4684 · Nota de Segurança
• https://github.com/advisories/GHSA-hm8g-jxjj-gfm3 · Nota
• http://secunia.com/advisories/21953 · Aviso do Fabricante
• http://securityfocus.com/bid/20022 · Nota
• http://debian.org/security/2006/dsa-1176 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hm8g-jxjj-gfm3 · Aviso do Fabricante