CVE-2023-36814: Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
(updated )
The use of Python’s marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable.
References
- github.com/advisories/GHSA-4hpj-8rhv-9x87
- github.com/pypa/advisory-database/tree/main/vulns/products-cmfcore/PYSEC-2023-113.yaml
- github.com/zopefoundation/Products.CMFCore
- github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5
- github.com/zopefoundation/Products.CMFCore/commit/c1847a9042abe7965271fa73762dfe091b576de
- github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
- nvd.nist.gov/vuln/detail/CVE-2023-36814
Code Behaviors & Features
Detect and mitigate CVE-2023-36814 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →