GitHub Advisoryadvisory · PyPI
GHSA-jcjp-qqpq-pc54 Zope allows local users to read arbitrary files
LOW
Official page ↗
- Aliases
- CVE-2006-3458
- Ecosystem
- PyPI
- Packages
- Zope2
- Severity
- Low
- Reviewed
- 2024-11-21
Affected packages
• PyPI Zope2: >= 2.7.0, < 2.7.8 → fixed in 2.7.8
• PyPI Zope2: >= 2.8.0, < 2.8.7 → fixed in 2.8.7
• PyPI Zope2: >= 2.9.0, < 2.9.3 → fixed in 2.9.3
Description
Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
Related
Alias · CVE (1)
- CVE-2006-3458 Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2006-3458 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27636 web
- https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-7.yaml web
- https://github.com/zopefoundation/Zope package
- https://usn.ubuntu.com/317-1 web
- http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html web
- http://www.debian.org/security/2006/dsa-1113 web
- http://www.novell.com/linux/security/advisories/2006_19_sr.html web