GitHub Advisoryadvisory · PyPI
GHSA-4x83-5gw5-q346 Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers
CRITICAL
Official page ↗
- Aliases
- CVE-2009-0668
- Ecosystem
- PyPI
- Packages
- ZODB3
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2024-04-29
Affected packages
• PyPI ZODB3: < 3.8.2 → fixed in 3.8.2
Description
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
Related
Alias · CVE (1)
- CVE-2009-0668 Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2009-0668 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52377 web
- https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-8.yaml web
- https://github.com/zopefoundation/ZODB3 package
- https://web.archive.org/web/20151023102330/http://secunia.com/advisories/36204 web
- https://web.archive.org/web/20151023102336/http://secunia.com/advisories/36205 web
- https://web.archive.org/web/20200229152709/http://www.securityfocus.com/bid/35987 web
- http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html web
- http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 web