Unscored severity · published Oct 19, 2010
CVE-2010-3495
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zodb · Zope
through 3.9.7; 2.8.11; 2.9.11; 2.10.9; 2.11.4; 3.1; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3495
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3495
Patch
http://bugs.python.org/issue6706
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
pypi.python.org
http://pypi.python.org/pypi/ZODB3/3.10.0#id1
Vendor Advisory
http://secunia.com/advisories/41755
www.openwall.com
http://www.openwall.com/lists/oss-security/2010/09/09/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2010/09/11/2
More from Zodb
–
CVE-2009-2701
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain…
–
CVE-2009-0669
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors…
–
CVE-2009-0668
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute…