p PatchFirst

CVE-2021-32811

CVE-2021-32811 · Remote Code Execution via Script (Python) objects under Python 3

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

CVSS 7.5 · High · EPSS 2.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • zope

    Versions
    • >= 4.0, < 4.6.3: Affected
    • >= 5.0, < 5.3: Affected

    No fix published

  • zope PyPI

    Versions
    • 4.0
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    • 4.6
    • 4.6.1
    • 4.6.2
    Affected ranges
    • ECOSYSTEM: ≥ 4.0, < 4.6.3

    Update to 4.6.3

  • zope PyPI

    Versions
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    • 5.2
    • 5.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 5.0, < 5.3

    Update to 5.3

  • zope PyPI

    Versions
    • 4.0
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    • 4.6
    • 4.6.1
    • 4.6.2
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    • 5.2
    • 5.2.1
    • 5.0a2
    • 5.0a1
    • 4.0b10
    • 4.0b9
    • 4.0b8
    • 4.0b7
    • 4.0b6
    • 4.0b5
    • 4.0b4
    • 4.0b3
    • 4.0b2
    • 4.0b1
    • 4.0a6
    • 4.0a5
    • 4.0a4
    • 4.0a3
    • 4.0a2
    • 4.0a1
    Affected ranges
    • GIT: < f72a18dda8e9bf2aedb46168761668464a4be988
    • ECOSYSTEM: ≥ 4.0, < 4.6.3 ∪ ≥ 5.0, < 5.3

    Update to 4.6.3; Update to 5.3

  • accesscontrol PyPI

    Versions
    • 4.0
    • 4.1
    • 4.2
    • 5.0
    • 5.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.0, < 4.3 ∪ ≥ 5.0, < 5.2

    Update to 4.3; Update to 5.2

  • zope2.13 Ubuntu:16.04:LTS

    Versions
    • 2.13.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zope2.13 Ubuntu:18.04:LTS

    Versions
    • 2.13.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →