PT-2006-4342 · Zope · Zope

Published 2006-07-07 · Updated 2022-05-01 · CVE-2006-3458

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zope versions 2.7.0 through 2.9.3

Description The issue allows local users to read arbitrary files due to the failure to disable the raw command when providing untrusted users with restructured text functionality from docutils.

Recommendations For versions 2.7.0 through 2.7.8, disable the raw command to prevent exploitation. For versions 2.8.0 through 2.8.7, disable the raw command to prevent exploitation. For versions 2.9.0 through 2.9.3, disable the raw command to prevent exploitation.

Fix

Related Identifiers

CVE-2006-3458

DSA-1113

GHSA-JCJP-QQPQ-PC54

PYSEC-2006-7

Affected Products

Zope

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2006-3458 · Security Note
• http://debian.org/security/2006/dsa-1113 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_19_sr.html · Vendor Advisory
• https://usn.ubuntu.com/317-1 · Vendor Advisory
• http://secunia.com/advisories/21025 · Vendor Advisory
• http://secunia.com/advisories/20988 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2681 · Vendor Advisory
• http://secunia.com/advisories/21130 · Vendor Advisory
• http://secunia.com/advisories/21459 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jcjp-qqpq-pc54 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2006-7 · Vendor Advisory
• https://github.com/zopefoundation/Zope · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-7.yaml · Note
• http://zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt · Note
• http://securityfocus.com/bid/18856 · Note