~ / search / GHSA-hm8g-jxjj-gfm3

GHSA-hm8g-jxjj-gfm3

Zope allows remote attackers to read arbitrary files

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-4684

Packages

EcosystemPackageAffectedFixed in
PyPI zope2 >= 2.7.0, <= 2.7.9 no fix listed
PyPI zope2 >= 2.8.0, < 2.8.9 2.8.9

Details

As written in the advisory (Markdown source, shown as plain text).

The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.

References

External links from the advisory. They lead to third-party sites.