CVE-2013-4199

Advisory

Plone 4.1, 4.2.5 and 4.3.1 include a fix for CVE-2013-4195: (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).

Affected package

Affected versions

Fixed versions

Vulnerability changelog

(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).


MLIST:[oss-security] 20130801 Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors): http://seclists.org/oss-sec/2013/q3/261
CONFIRM:http://plone.org/products/plone-hotfix/releases/20130618: http://plone.org/products/plone-hotfix/releases/20130618
CONFIRM:http://plone.org/products/plone/security/advisories/20130618-announcement: http://plone.org/products/plone/security/advisories/20130618-announcement
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=978482: https://bugzilla.redhat.com/show_bug.cgi?id=978482

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4199
• http://plone.org/products/plone-hotfix/releases/20130618
• http://plone.org/products/plone/security/advisories/20130618-announcement
• https://bugzilla.redhat.com/show_bug.cgi?id=978482
• http://seclists.org/oss-sec/2013/q3/261