GHSA-jcjp-qqpq-pc54

Zope allows local users to read arbitrary files

Source: GitHub Advisory Database (reviewed) Low CVE-2006-3458

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Zope2	>= 2.7.0, < 2.7.8	2.7.8
PyPI	Zope2	>= 2.8.0, < 2.8.7	2.8.7
PyPI	Zope2	>= 2.9.0, < 2.9.3	2.9.3

Details

As written in the advisory (Markdown source, shown as plain text).

Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-3458 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27636 web
https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-7.yaml web
https://github.com/zopefoundation/Zope package
https://usn.ubuntu.com/317-1 web
http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html web
http://www.debian.org/security/2006/dsa-1113 web
http://www.novell.com/linux/security/advisories/2006_19_sr.html web