Red Hat Bugzilla – Bug 471237
CVE-2008-5102 Zope 2, conga: DoS via various python scripts insufficiencies
Last modified: 2010-12-23 21:09:46 EST
A security flaw was discovered in python scripts shipped within the Zope application server framework of version 2. Local user with unrestricted
access to the ZMI and ability to edit python scripts could use this flaw
to cause the whole Zope 2 instance shutdown or to import the 'test' module
of Python and execute all tests (DoS).
Affected Zope 2 versions: Zope 2.7.0 to Zope 2.11.2
Proposed patch: http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz
Note: This issue also affects the PythonScripts of the Zope 2 package,
as shipped within the Conga project:
-- conga-0.9.1-8 contains Zope-2.7.5 RC2
-- conga-0.12.0-7.el5 contains Zope-2.8.4
This issue affects the conga package, as shipped with Red Hat Enterprise Linux
5 Update 2 (conga-0.12.0-7.el5), with Red Hat Enterprise Linux 4 Cluster Suite (conga-0.9.1-8) and within the Extra Packages for Enterprise Linux 5 project
This issue does NOT affect the versions of the python-zope-interface package,
as shipped within the Fedora releases of 8, 9 and 10 and withing EPEL 4 and 5.
CVE id CVE-2008-5102 was assigned to this issue:
PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
The zope currently in EPEL is not vulnerable as the hotfix was integrated as of Zope 2.10.7, currently 2.10.9 is latest: