GitHub Advisoryadvisory · PyPI

GHSA-vwrc-g9q6-f675 Zope Server vulnerable to DoS via header injection

MEDIUM Published 2022-04-30 Modified 2024-02-12 Official page ↗
Aliases
CVE-2002-0687
Ecosystem
PyPI
Packages
zope
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2024-02-12

Affected packages

• PyPI zope: >= 2.0.0, < 2.4.4b2 → fixed in 2.4.4b2 • PyPI zope: >= 2.5.0, < 2.5.1b2 → fixed in 2.5.1b2

Description

Zope is a Web application server for Linux. Zope versions 2.0 through 2.5.1 b1 are vulnerable to a denial of service attack, caused by a vulnerability that occurs when using the "through the Web code" capability. A remote attacker could inject malicious headers into a response to cause the vulnerable system to crash.

Related

Alias · CVE (1)

  • CVE-2002-0687 The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References