CVE-2010-3495

描述

Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.

如何修補 CVE-2010-3495

要修補 CVE-2010-3495,請將受影響套件升級到下列已修補版本。

• PyPI/zodb3—升級至 3.10.0a2 或更新版本
• —升級至 3.10.0a1 或更新版本

CVE-2010-3495 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.10.0a2
• from 0, < 3.10.0a1

參考連結(15)

• ADVISORYgithub.com/advisories/GHSA-j6m4-frxh-p4x8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2010-3495
• WEBbugs.python.org/issue6706
• WEBlists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• WEB