PT-2009-2017 · Python · Formencode

Petter Urkedal · Published 2009-03-30 · Updated 2022-05-17 · CVE-2008-6547

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FormEncode for Python (python-formencode) version 1.0

Description The issue allows attackers to bypass intended access restrictions via unknown vectors because the chained validators feature is not applied in schema.py.

Recommendations For version 1.0, consider applying the chained validators feature to schema.py to prevent attackers from bypassing access restrictions. As a temporary workaround, review and manually enforce access restrictions to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-6547

GHSA-9JP4-68VC-R8WQ

PYSEC-2009-5

Affected Products

Formencode

References · 19

• http://secunia.com/advisories/31163 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2009-5 · Vendor Advisory
• http://secunia.com/advisories/31081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6547 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-6547 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00607.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9jp4-68vc-r8wq · Vendor Advisory
• http://sourceforge.net/tracker/download.php?group_id=91231&atid=596416&file_id=271779&aid=1925164 · Patch
• https://security-tracker.debian.org/tracker/CVE-2008-6547 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-6547 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/formencode/PYSEC-2009-5.yaml · Note
• https://github.com/davidfraser/formencode · Note
• http://osvdb.org/47082 · Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=1925164&group_id=91231&atid=596416 · Note
• https://web.archive.org/web/20200228145643/http://securityfocus.com/bid/30282 · Note