GHSA-5432-c996-hvhj

Zope Object Database (ZODB) Authentication bypass in ZEO storage servers

Source: GitHub Advisory Database (reviewed) High CVE-2009-0669

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ZODB3	< 3.8.2	3.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-0669 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52379 web
https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-9.yaml web
https://github.com/zopefoundation/ZODB3 package
http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html web
http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 web