Zope Object Database (ZODB) Authentication bypass in ZEO storage servers

高危 7.5CVE-2009-0669 · GHSA-5432-c996-hvhj · PYSEC-2009-9 · Published 07/08/2009 · updated 16/06/2026

要点

CVE-2009-0669 是影响 zodb3, zodb (zope) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.9%，高于 86.8% 的漏洞。
修复：升级到 3.8.2 或更高版本。

Package	Affected versions	Patched versions
zodb3 PyPI	`< 3.8.2`	`3.8.2`
zodb zope	`= 3.8= 3.8.0≤ 3.8.1`	No fix yet

Description

Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2009-0669 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/52379 · WEB
pypa/advisory-database · WEB
zopefoundation/ZODB3 · PACKAGE
mail.zope.org/pipermail/zope-announce/2009-August/002220.html · WEB
pypi.python.org/pypi/ZODB3/3.8.2 · WEB
osvdb.org/56826
secunia.com/advisories/36204 · Vendor Advisory
secunia.com/advisories/36205 · Vendor Advisory
securityfocus.com/bid/35987
vupen.com/english/advisories/2009/2217
GitHub Advisory GHSA-5432-c996-hvhj · ADVISORY

zodb3 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

zodb3

PyPI

< 3.8.2

3.8.2

zodb

zope

= 3.8= 3.8.0≤ 3.8.1

No fix yet

Description

NVD description

zodb3 的其他漏洞

查看全部 →