CVE-2009-0668

Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers

6.5 MediumFix available

Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.

Exploit likelihood

2.16%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2009-0668
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-0668
Updated: 2026-11-02

EUVDEUVD-2009-0012 No score

Record: EUVD-2009-0012
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4x83-5gw5-q346 9.3

Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers

Record: GHSA-4x83-5gw5-q346
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-4x83-5gw5-q346 9.3

Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers

Record: GHSA-4x83-5gw5-q346
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV No score

Record: CVE-2009-0668
Updated: 2026-11-02

OSVPYSEC-2009-8 No score

Record: PYSEC-2009-8
Updated: 2026-11-02

Affected products

zope zodb

Affected packages

Affected packages
Package	Affected	Fixed
`zodb3` PyPI	before 3.8.2	3.8.2
`zope2.10` Debian:5.0	before 2.10.6-1+lenny1, plus listed versions 2.10.6-1	2.10.6-1+lenny1
`zope2.9` Debian:4.0	before 2.9.6-4etch2, plus listed versions 2.9.6-4etch1	2.9.6-4etch2
`zodb` Debian:5.0	before 1:3.6.0-2+lenny3, plus listed versions 1:3.6.0-2	1:3.6.0-2+lenny3
`zodb3` PyPI	before 3.8.2, plus listed versions 3.1.53.2.103.3.13.4.23.5.0 Show 21 moreShow less 3.5.13.6.03.7.03.7.23.8.03.8.0a13.8.0b13.8.0b23.8.0b33.8.0b43.8.0c13.8.13.8.1b13.8.1b23.8.1b33.8.1b43.8.1b53.8.1b63.8.1b73.8.1b83.8.1b9	3.8.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0668 is a medium vulnerability (CVSS 6.5) in Zope Zodb, published August 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in zodb3 3.8.2.

References

Show 9 moreShow less