PT-2014-2326 · Plone+1 · Plone+1

Richard Mitchell · Publicado 2014-09-16 · Atualizado 2023-02-13 · CVE-2012-5499

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a large value. This is related to the formatColumns function.

Recommendations For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later. As a temporary workaround, consider restricting access to the formatColumns function until a patch is available.

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-399

CWE-770

Identificadores relacionados

CVE-2012-5499

GHSA-WRF2-2RCH-CMR9

PYSEC-2014-41

RHSA-2014:1194

RHSA-2014_1194

Produtos afetados

Plone

Red Hat

Referências · 22

• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-41.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://access.redhat.com/security/cve/CVE-2012-5500 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5499 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2012-5498 · Nota
• https://plone.org/products/plone/security/advisories/20121106/15 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-41 · Aviso do Fabricante
• https://plone.org/products/plone-hotfix/releases/20121106 · Correção
• https://access.redhat.com/security/cve/CVE-2014-3521 · Nota
• https://osv.dev/vulnerability/GHSA-wrf2-2rch-cmr9 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2012-5485 · Nota
• https://access.redhat.com/security/cve/CVE-2012-5497 · Nota
• https://access.redhat.com/errata/RHSA-2014:1194 · Nota
• https://access.redhat.com/security/cve/CVE-2012-5486 · Nota