Moderate severity vulnerability that affects Plone and Zope2 · CVE-2012-6661 · GitHub Advisory Database · GitHub

Moderate severity vulnerability that affects Plone and Zope2

Moderate severity GitHub Reviewed Published Jul 23, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

Plone (pip)

Affected versions

>= 3.2.2, < 4.2.3

>= 4.3a1, <= 4.3a2

Patched versions

4.2.3

4.3b1

Zope2 (pip)

< 2.13.19

2.13.19

Description

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).

References

Published to the GitHub Advisory Database Jul 23, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023