SB2025060835 - Race condition in Zope

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2012-5507)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2012/11/10/1
• https://bugs.launchpad.net/zope2/+bug/1071067
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
• https://plone.org/products/plone/security/advisories/20121106/23
• https://plone.org/products/plone-hotfix/releases/20121106