PT-2010-4637 · Zope · Zope

Do3Cc + 1 · Published 2010-09-08 · Updated 2022-05-17 · CVE-2010-3198

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions 2.10.x through 2.10.11 Zope versions 2.11.x through 2.11.6

Description The issue allows remote attackers to cause a denial of service, leading to the crash of worker threads, via vectors that trigger uncaught exceptions.

Recommendations For Zope versions 2.10.x through 2.10.11, update to version 2.10.12 or later. For Zope versions 2.11.x through 2.11.6, update to version 2.11.7 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2010-3198

GHSA-QH4Q-FWF8-QQRW

PYSEC-2010-32

PYSEC-2010-33

Affected Products

Zope

References · 16

• 🔥 https://bugs.launchpad.net/zope2/+bug/627988 · Exploit
• https://osv.dev/vulnerability/GHSA-qh4q-fwf8-qqrw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3198 · Security Note
• http://vupen.com/english/advisories/2010/2275 · Vendor Advisory
• https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-33 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2010-32 · Vendor Advisory
• https://github.com/zopefoundation/Zope/commit/0f2f56f63e4a4d695ee670e02b317e900550dbac · Note
• https://github.com/zopefoundation/Zope · Note
• https://github.com/zopefoundation/Zope/commit/e03a5f036d42ed2426886c9035fe018eeec65de4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2010-33.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2010-32.yaml · Note
• http://zope.org/Products/Zope/2.11.7/CHANGES.txt · Note
• http://securityfocus.com/bid/42939 · Note
• https://web.archive.org/web/20200229173503/http://securityfocus.com/bid/42939 · Note