REDHAT-BUG-742297: Medium severity zope zodb vulnerability
Plone upstream has published a pre-announcement about a security flaw, present in Zope v2.12.x and Zope v2.13.x, which could allow execution of arbitrary code by anonymous users. An authenticated attacker could provide a specially-crafted web page, which once visited by an unsuspecting Zope user would lead to arbitrary commands execution with the privileges of the Zope/Plone service.
References: [1] http://plone.org/products/plone/security/advisories/20110928 [2] http://secunia.com/advisories/46221/
Note: The vendor announced the final version of the advisory and the patch to be available at 2011-10-04 15:00 UTC at the following location: [3] http://plone.org/products/plone/security/advisories/20110928
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-742297?
The severity of REDHAT-BUG-742297 is critical due to the potential for arbitrary code execution by anonymous users.
How do I fix REDHAT-BUG-742297?
To fix REDHAT-BUG-742297, upgrade Zope to a version later than 2.13.x.
Who is affected by REDHAT-BUG-742297?
Users of Zope versions 2.12.x and 2.13.x are affected by REDHAT-BUG-742297.
What type of vulnerability is REDHAT-BUG-742297?
REDHAT-BUG-742297 is classified as a remote code execution vulnerability.
What can attackers do in REDHAT-BUG-742297?
Attackers can execute arbitrary code on the system through a specially-crafted web page in REDHAT-BUG-742297.