zodb3@3.8.0b1 vulnerabilities

ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO

Direct Vulnerabilities

Known vulnerabilities in the zodb3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Control of Generation of Code ('Code Injection')

ZODB3 is a ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to the handling of certain Zope Enterprise Objects (ZEO) database sharing configurations. An attacker can execute arbitrary Python code via vectors involving the ZEO network protocol.

Note:

The vulnerability only applies if the user is using ZEO to share a database among multiple applications or application instances and if untrusted clients are able to connect to the ZEO servers.

How to fix Improper Control of Generation of Code ('Code Injection')?

Upgrade ZODB3 to version 3.8.2 or higher.

[,3.8.2)
  • M
Improper Access Control

ZODB3 is a ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO

Affected versions of this package are vulnerable to Improper Access Control due to improper handling of ZEO database sharing and blob support. An attacker can read or delete arbitrary files by exploiting unknown vectors.

Note

This vulnerability is only exploitable when:

  1. Using ZEO to share a database among multiple applications or application instances,

  2. Allowing untrusted clients to connect to your ZEO server, and the ZEO server is configured to support blobs.

How to fix Improper Access Control?

Upgrade ZODB3 to version 3.8.3, 3.9.0c2 or higher.

[3.8.0a1,3.8.3) [3.9.0,3.9.0c2)
  • M
Authentication Bypass

ZODB3 is a ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO

Affected versions of this package are vulnerable to Authentication Bypass such that when specific Zope Enterprise Objects (ZEO) database sharing is enabled, it allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.

How to fix Authentication Bypass?

Upgrade ZODB3 to version 3.8.2 or higher.

[,3.8.2)