PT-2021-14430 · Unknown · Zodb Role Manager+1

Dataflake · Published 2021-03-08 · Updated 2022-06-03 · CVE-2021-21336

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Products.PluggableAuthService versions prior to 2.6.0

Description The issue is an information disclosure vulnerability where everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0.

Recommendations For versions prior to 2.6.0, change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do pip install "Products.PluggableAuthService>=2.6.0".

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21336

GHSA-P75F-G7GX-2R7P

PYSEC-2021-44

Affected Products

Products.Pluggableauthservice

Zodb Role Manager

References · 13

• https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bb · Patch
• https://osv.dev/vulnerability/GHSA-p75f-g7gx-2r7p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21336 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-44 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21336 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/products-pluggableauthservice/PYSEC-2021-44.yaml · Note
• https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p · Note
• https://github.com/zopefoundation/Products.PluggableAuthService · Note
• https://pypi.org/project/Products.PluggableAuthService · Note
• http://openwall.com/lists/oss-security/2021/05/21/1 · Note
• https://t.me/cvenotify/14886 · Telegram Post
• http://openwall.com/lists/oss-security/2021/05/22/1 · Note
• https://t.me/cvenotify/31076 · Telegram Post