PT-2009-1029 · Zope+1 · Zodb+1

Published 2009-08-07 · Updated 2022-05-02 · CVE-2009-0668

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions prior to 3.8.2

Description The issue concerns multiple vulnerabilities in the ZODB package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerability allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol when certain Zope Enterprise Objects (ZEO) database sharing is enabled.

Recommendations For Zope Object Database (ZODB) versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider disabling the ZEO database sharing feature until a patch is available. Restrict access to the ZEO network protocol to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-03397

CVE-2009-0668

DSA-1863-1

DSA-2234-1

GHSA-4X83-5GW5-Q346

PYSEC-2009-8

Affected Products

Debian

Zodb

References · 21

• https://osv.dev/vulnerability/GHSA-4x83-5gw5-q346 · Vendor Advisory
• http://secunia.com/advisories/36205 · Vendor Advisory
• http://secunia.com/advisories/36204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03397 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0668 · Security Note
• https://osv.dev/vulnerability/CVE-2009-0668 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0669 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0668 · Security Note
• https://osv.dev/vulnerability/PYSEC-2009-8 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-8.yaml · Note
• https://github.com/zopefoundation/ZODB3 · Note
• http://osvdb.org/56827 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52377 · Note
• http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html · Note
• http://vupen.com/english/advisories/2009/2217 · Note