PT-2009-2017 · Python · Formencode

Petter Urkedal · Publicado 2009-03-30 · Atualizado 2022-05-17 · CVE-2008-6547

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FormEncode for Python (python-formencode) version 1.0

Description The issue allows attackers to bypass intended access restrictions via unknown vectors because the chained validators feature is not applied in schema.py.

Recommendations For version 1.0, consider applying the chained validators feature to schema.py to prevent attackers from bypassing access restrictions. As a temporary workaround, review and manually enforce access restrictions to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-6547

GHSA-9JP4-68VC-R8WQ

PYSEC-2009-5

Produtos afetados

Formencode

Referências · 19

• https://github.com/pypa/advisory-database/tree/main/vulns/formencode/PYSEC-2009-5.yaml · Nota
• https://github.com/davidfraser/formencode · Nota
• http://secunia.com/advisories/31163 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2009-5 · Aviso do Fabricante
• http://secunia.com/advisories/31081 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6547 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-6547 · Aviso do Fabricante
• http://osvdb.org/47082 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00607.html · Aviso do Fabricante
• http://sourceforge.net/tracker/index.php?func=detail&aid=1925164&group_id=91231&atid=596416 · Nota
• https://osv.dev/vulnerability/GHSA-9jp4-68vc-r8wq · Aviso do Fabricante
• https://web.archive.org/web/20200228145643/http://securityfocus.com/bid/30282 · Nota
• http://sourceforge.net/tracker/download.php?group_id=91231&atid=596416&file_id=271779&aid=1925164 · Correção
• http://securityfocus.com/bid/30282 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-6547 · Aviso do Fabricante