Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers

MEDIUM 6.5CVE-2009-0668 · GHSA-4x83-5gw5-q346 · PYSEC-2009-8 · Published 07/08/2009 · updated 16/06/2026

In short

CVE-2009-0668 is a MEDIUM (CVSS 6.5) vulnerability affecting zodb3, zodb (zope).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.2% of all vulnerabilities.
Fix: update to 3.8.2 or later.

Package	Affected versions	Patched versions
zodb3 PyPI	`< 3.8.2`	`3.8.2`
zodb zope	`= 2.10.9= 2.11.4= 2.8.11= 2.9.11= 3.1= 3.1.1= 3.2= 3.2.4= 3.3= 3.3.3= 3.4= 3.4.1= 3.5= 3.6= 3.7= 3.8.0≤ 3.8.1`	No fix yet

Description

Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2009-0668 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/52377 · WEB
pypa/advisory-database · WEB
zopefoundation/ZODB3 · PACKAGE
web.archive.org/web/20151023102330/http://secunia.com/advisories/36204 · WEB
web.archive.org/web/20151023102336/http://secunia.com/advisories/36205 · WEB
web.archive.org/web/20200229152709/http://www.securityfocus.com/bid/35987 · WEB
mail.zope.org/pipermail/zope-announce/2009-August/002220.html · WEB
pypi.python.org/pypi/ZODB3/3.8.2 · WEB
osvdb.org/56827
secunia.com/advisories/36204 · Vendor Advisory
secunia.com/advisories/36205

More vulnerabilities in zodb3

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free