CVE-2023-36814: Allocation of Resources Without Limits or Throttling
(updated )
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python’s marshal module to handle unchecked input in a public method on PortalFolder
objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore
, such as Plone. All deployments is vulnerable. The code has been fixed in Products.CMFCore
version 3.2.
References
- github.com/advisories/GHSA-4hpj-8rhv-9x87
- github.com/pypa/advisory-database/tree/main/vulns/products-cmfcore/PYSEC-2023-113.yaml
- github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5
- github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
- nvd.nist.gov/vuln/detail/CVE-2023-36814
Detect and mitigate CVE-2023-36814 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →