GHSA-4x83-5gw5-q346

Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers

Source: GitHub Advisory Database (reviewed) Critical CVE-2009-0668

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ZODB3	< 3.8.2	3.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-0668 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52377 web
https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-8.yaml web
https://github.com/zopefoundation/ZODB3 package
https://web.archive.org/web/20151023102330/http://secunia.com/advisories/36204 web
https://web.archive.org/web/20151023102336/http://secunia.com/advisories/36205 web
https://web.archive.org/web/20200229152709/http://www.securityfocus.com/bid/35987 web
http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html web
http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 web