Bug 471237 - (CVE-2008-5102) CVE-2008-5102 Zope 2, conga: DoS via various python scripts insufficiencies
CVE-2008-5102 Zope 2, conga: DoS via various python scripts insufficiencies
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
reported=20081112,public=20081111,sou...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-11-12 11:03 EST by Jan Lieskovsky
Modified: 2010-12-23 21:09 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-12-23 21:09:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2008-11-12 11:03:57 EST
A security flaw was discovered in python scripts shipped within the Zope application server framework of version 2. Local user with unrestricted
access to the ZMI and ability to edit python scripts could use this flaw
to cause the whole Zope 2 instance shutdown or to import the 'test' module
of Python and execute all tests (DoS).

Affected Zope 2 versions: Zope 2.7.0 to Zope 2.11.2

Proposed patch: http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz

References:
http://bugs.gentoo.org/show_bug.cgi?id=246411
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/README.txt
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz


Note: This issue also affects the PythonScripts of the Zope 2 package,
      as shipped within the Conga project:
        -- conga-0.9.1-8 contains Zope-2.7.5 RC2
        -- conga-0.12.0-7.el5 contains Zope-2.8.4
Comment 1 Jan Lieskovsky 2008-11-12 11:08:30 EST
This issue affects the conga package, as shipped with Red Hat Enterprise Linux
5 Update 2 (conga-0.12.0-7.el5), with Red Hat Enterprise Linux 4 Cluster Suite (conga-0.9.1-8) and within the Extra Packages for Enterprise Linux 5 project
(zope-2.10.6-1.el5).

This issue does NOT affect the versions of the python-zope-interface package,
as shipped within the Fedora releases of 8, 9 and 10 and withing EPEL 4 and 5.
Comment 2 Tomas Hoger 2008-11-18 03:08:42 EST
CVE id CVE-2008-5102 was assigned to this issue:

PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
Comment 3 Jonathan Steffan 2009-09-07 18:09:25 EDT
The zope currently in EPEL is not vulnerable as the hotfix was integrated as of Zope 2.10.7, currently 2.10.9 is latest:

http://koji.fedoraproject.org/koji/buildinfo?buildID=126121

Note You need to log in before you can comment on or make changes to this bug.