PT-2009-1029 · Zope+1 · Zodb+1

Publicado 2009-08-07 · Atualizado 2022-05-02 · CVE-2009-0668

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions prior to 3.8.2

Description The issue concerns multiple vulnerabilities in the ZODB package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerability allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol when certain Zope Enterprise Objects (ZEO) database sharing is enabled.

Recommendations For Zope Object Database (ZODB) versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider disabling the ZEO database sharing feature until a patch is available. Restrict access to the ZEO network protocol to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2015-03397

CVE-2009-0668

DSA-1863-1

DSA-2234-1

GHSA-4X83-5GW5-Q346

PYSEC-2009-8

Produtos afetados

Debian

Zodb

Referências · 21

• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-8.yaml · Nota
• https://github.com/zopefoundation/ZODB3 · Nota
• https://osv.dev/vulnerability/GHSA-4x83-5gw5-q346 · Aviso do Fabricante
• http://osvdb.org/56827 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52377 · Nota
• http://secunia.com/advisories/36205 · Aviso do Fabricante
• http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html · Nota
• http://secunia.com/advisories/36204 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-03397 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-0668 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-0668 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0669 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0668 · Nota de Segurança
• http://vupen.com/english/advisories/2009/2217 · Nota
• http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 · Nota