CVE-2009-0668
Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers
CVE-2009-0668 is a medium vulnerability (CVSS 6.5) in Zope Zodb, published August 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in zodb3 3.8.2.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 2.16%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.2zodb3 +4 more
Description
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zodb3PyPI | before 3.8.2 | 3.8.2 |
zope2.10Debian:5.0 From an advisory covering 2 CVEs | before 2.10.6-1+lenny1, plus listed versions 2.10.6-1 | 2.10.6-1+lenny1 |
zope2.9Debian:4.0 From an advisory covering 2 CVEs | before 2.9.6-4etch2, plus listed versions 2.9.6-4etch1 | 2.9.6-4etch2 |
zodbDebian:5.0 From an advisory covering 2 CVEs | before 1:3.6.0-2+lenny3, plus listed versions 1:3.6.0-2 | 1:3.6.0-2+lenny3 |
zodb3PyPI | before 3.8.2, plus listed versions 3.1.53.2.103.3.13.4.23.5.0 Show 21 moreShow less3.5.13.6.03.7.03.7.23.8.03.8.0a13.8.0b13.8.0b23.8.0b33.8.0b43.8.0c13.8.13.8.1b13.8.1b23.8.1b33.8.1b43.8.1b53.8.1b63.8.1b73.8.1b83.8.1b9 | 3.8.2 |
What each source reports
NVD Score used
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
CVE-2009-0668- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
CVE-2009-0668- Updated
- 2026-11-02
EUVDEUVD-2009-0012No score
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
EUVD-2009-0012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4x83-5gw5-q346
Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
GHSA-4x83-5gw5-q346- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-4x83-5gw5-q346
Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
GHSA-4x83-5gw5-q346- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVNo score
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
CVE-2009-0668- Updated
- 2026-11-02
OSVPYSEC-2009-8No score
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
- Record
PYSEC-2009-8- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2009/2217
secunia.com/advisories/36204
exchange.xforce.ibmcloud.com/vulnerabilities/52377
pypi.python.org/pypi/ZODB3/3.8.2
mail.zope.org/pipermail/zope-announce/2009-August/002220.html
Show 9 moreShow less
osvdb.org/56827
securityfocus.com/bid/35987
nvd.nist.gov/vuln/detail/CVE-2009-0668
web.archive.org/web/20151023102330/http://secunia.com/advisories/36204
github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-8.yaml