Homepage
About Snyk

Improper Control of Generation of Code ('Code Injection') Affecting zodb3 package, versions [,3.8.2)

0.0
medium

Snyk CVSS

    Attack Complexity High

    Threat Intelligence

    EPSS 0.57% (78th percentile)
Expand this section
NVD
6.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-ZODB3-6692210
  • published 29 Apr 2024
  • disclosed 2 May 2022
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 2 May 2022

CVE-2009-0668 Open this link in a new tab
CWE-94 Open this link in a new tab

How to fix?

Upgrade ZODB3 to version 3.8.2 or higher.

Overview

ZODB3 is a ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to the handling of certain Zope Enterprise Objects (ZEO) database sharing configurations. An attacker can execute arbitrary Python code via vectors involving the ZEO network protocol.

Note:

The vulnerability only applies if the user is using ZEO to share a database among multiple applications or application instances and if untrusted clients are able to connect to the ZEO servers.