oss-security - CVE Request - Zope 2 - PythonScripts local DoS

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 12 Nov 2008 16:41:21 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...re.org>
Cc: oss-security@...ts.openwall.com
Subject: CVE Request - Zope 2 - PythonScripts local DoS

Hello Steve,

  could you please allocate a new CVE id for the following
Zope 2 related issue:

"PythonScripts in Zope 2 can be misused for shutting down a complete   
 Zope 2 instance or misused for a local denial-of-service attack."    (from Hotfix-2008-08-12/README.txt)

References:
http://bugs.gentoo.org/show_bug.cgi?id=246411
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/README.txt

The Hotfix-2008-08-12 is available at:
http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz

Affected Zope versions: Zope 2.7.0 to Zope 2.11.2 (from Hotfix-2008-08-12/README.txt)

Note: This issue affects also the Zope 2 Python scripts, as shipped within the
      Conga project (Zope 2 shipped within the luci-* rpm package). 
       
      Affected Conga versions: - checked conga-0.9.1-8 (contains Zope2.7.5 RC2), conga-0.12.0-7.el5 (contains Zope-2.8.4),
                               - but older,newer Conga versions can be also vulnerable to this issue (based on Zope 2 version).


Thanks, Jan.
-- 
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.