GHSA-m52m-2qpx-9j4j

Zope Object Database (ZODB) Arbitrary files reading and deletion

Source: GitHub Advisory Database (reviewed) Critical CVE-2009-2701

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ZODB3	>= 3.8, < 3.8.3	3.8.3
PyPI	ZODB3	>= 3.9a0, < 3.9.0c2	3.9.0c2

Details

As written in the advisory (Markdown source, shown as plain text).

Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2009-2701 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-10.yaml web
https://github.com/zopefoundation/ZODB3 package
https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html web
http://pypi.python.org/pypi/ZODB3/3.8.3 web
http://pypi.python.org/pypi/ZODB3/3.9.0c2 web