Description
The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zope | >= 2.0.0, < 2.4.4b2 | 2.4.4b2 | GHSA-vwrc-g9q6-f675 |
| PyPI | zope | >= 2.5.0, < 2.5.1b2 | 2.5.1b2 | GHSA-vwrc-g9q6-f675 |
| PyPI | zope | >= 2.0.0, < 2.4.4b2 · >= 2.5.0, < 2.5.1b2 | 2.4.4b2, 2.5.1b2 | PYSEC-2026-761 |
References
- 5813 vdb-entry
- RHSA-2002:060 vendor-advisory
- 5166 vdb-entry
- zope-inject-headers-dos(9621) vdb-entry
- http://www.zope.org/Products/Zope/Hotfix_2002-04-15/security_alert