GitHub Advisoryadvisory · PyPI
GHSA-5432-c996-hvhj Zope Object Database (ZODB) Authentication bypass in ZEO storage servers
HIGH
Official page ↗
- Aliases
- CVE-2009-0669
- Ecosystem
- PyPI
- Packages
- ZODB3
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2024-04-01
Affected packages
• PyPI ZODB3: < 3.8.2 → fixed in 3.8.2
Description
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
Related
Alias · CVE (1)
- CVE-2009-0669 Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2009-0669 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52379 web
- https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-9.yaml web
- https://github.com/zopefoundation/ZODB3 package
- http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html web
- http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 web