製品・ソフトウェアに関する情報

JVN脆弱性詳細

Plone の Kupu の kupu_spellcheck.py におけるサービス運用妨害 (DoS) 状態にされる脆弱性

タイトル	Plone の Kupu の kupu_spellcheck.py におけるサービス運用妨害 (DoS) 状態にされる脆弱性
概要	Plone の Kupu の kupu_spellcheck.py には、サービス運用妨害 (ZServer スレッドロック) 状態にされる脆弱性が存在します。
想定される影響	第三者により、巧妙に細工された URL を介して、サービス運用妨害 (ZServer スレッドロック) 状態にされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2012年11月6日0:00
登録日	2014年10月3日14:51
最終更新日	2014年10月3日14:51

CVSS2.0 : 警告
スコア	5
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P

影響を受けるシステム

Plone Foundation

Plone 4.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5496	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5496
National Vulnerability Database (NVD)
2	CVE-2012-5496	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5496

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	名前	URL
GitHub
1	Products.CMFPlone	https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
Plone
2	DoS through unsanitised inputs into Kupu	https://plone.org/products/plone/security/advisories/20121106/12
3	Plone Hotfix 20121106 (Nov 06, 2012)	https://plone.org/products/plone-hotfix/releases/20121106

その他

No	名前	URL
関連文書
1	GitHub_kupu	https://github.com/collective/kupu

変更履歴

No	変更内容	変更日
0	[2014年10月03日] 掲載	2018年2月17日10:37

NVD脆弱性情報

CVE-2012-5496

概要	kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
公表日	2014年9月30日23:55
登録日	2021年1月28日15:05
最終更新日	2024年11月21日10:44

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:plone:plone:3.3:::::::*
cpe:2.3:a:plone:plone:1.0:::::::*
cpe:2.3:a:plone:plone:3.0.1:::::::*
cpe:2.3:a:plone:plone:1.0.3:::::::*
cpe:2.3:a:plone:plone:3.0:::::::*
cpe:2.3:a:plone:plone:3.2.3:::::::*
cpe:2.3:a:plone:plone::::::::		3.3.5
cpe:2.3:a:plone:plone:3.1.4:::::::*
cpe:2.3:a:plone:plone:3.1.5.1:::::::*
cpe:2.3:a:plone:plone:2.1.4:::::::*
cpe:2.3:a:plone:plone:3.0.6:::::::*
cpe:2.3:a:plone:plone:2.5.4:::::::*
cpe:2.3:a:plone:plone:3.2:::::::*
cpe:2.3:a:plone:plone:3.1.1:::::::*
cpe:2.3:a:plone:plone:2.1.1:::::::*
cpe:2.3:a:plone:plone:3.3.4:::::::*
cpe:2.3:a:plone:plone:2.0.3:::::::*
cpe:2.3:a:plone:plone:1.0.4:::::::*
cpe:2.3:a:plone:plone:3.3.2:::::::*
cpe:2.3:a:plone:plone:2.0:::::::*
cpe:2.3:a:plone:plone:3.1.7:::::::*
cpe:2.3:a:plone:plone:2.5.1:::::::*
cpe:2.3:a:plone:plone:2.5.3:::::::*
cpe:2.3:a:plone:plone:3.2.2:::::::*
cpe:2.3:a:plone:plone:2.0.4:::::::*
cpe:2.3:a:plone:plone:2.1.2:::::::*
cpe:2.3:a:plone:plone:1.0.1:::::::*
cpe:2.3:a:plone:plone:3.0.3:::::::*
cpe:2.3:a:plone:plone:3.3.1:::::::*
cpe:2.3:a:plone:plone:3.0.4:::::::*
cpe:2.3:a:plone:plone:2.0.1:::::::*
cpe:2.3:a:plone:plone:2.0.2:::::::*
cpe:2.3:a:plone:plone:3.1.2:::::::*
cpe:2.3:a:plone:plone:3.2.1:::::::*
cpe:2.3:a:plone:plone:1.0.2:::::::*
cpe:2.3:a:plone:plone:2.0.5:::::::*
cpe:2.3:a:plone:plone:3.0.5:::::::*
cpe:2.3:a:plone:plone:2.5:::::::*
cpe:2.3:a:plone:plone:1.0.6:::::::*
cpe:2.3:a:plone:plone:2.5.2:::::::*
cpe:2.3:a:plone:plone:3.0.2:::::::*
cpe:2.3:a:plone:plone:2.1:::::::*
cpe:2.3:a:plone:plone:3.1:::::::*
cpe:2.3:a:plone:plone:3.3.3:::::::*
cpe:2.3:a:plone:plone:2.1.3:::::::*
cpe:2.3:a:plone:plone:3.1.6:::::::*
cpe:2.3:a:plone:plone:3.1.3:::::::*
cpe:2.3:a:plone:plone:1.0.5:::::::*
cpe:2.3:a:plone:plone:2.5.5:::::::*

構成1	以上	以下	より上	未満
cpe:2.3:a:plone:plone:3.3:::::::*
cpe:2.3:a:plone:plone:1.0:::::::*
cpe:2.3:a:plone:plone:3.0.1:::::::*
cpe:2.3:a:plone:plone:1.0.3:::::::*
cpe:2.3:a:plone:plone:3.0:::::::*
cpe:2.3:a:plone:plone:3.2.3:::::::*
cpe:2.3:a:plone:plone::::::::		3.3.5
cpe:2.3:a:plone:plone:3.1.4:::::::*
cpe:2.3:a:plone:plone:3.1.5.1:::::::*
cpe:2.3:a:plone:plone:2.1.4:::::::*
cpe:2.3:a:plone:plone:3.0.6:::::::*
cpe:2.3:a:plone:plone:2.5.4:::::::*
cpe:2.3:a:plone:plone:3.2:::::::*
cpe:2.3:a:plone:plone:3.1.1:::::::*
cpe:2.3:a:plone:plone:2.1.1:::::::*
cpe:2.3:a:plone:plone:3.3.4:::::::*
cpe:2.3:a:plone:plone:2.0.3:::::::*
cpe:2.3:a:plone:plone:1.0.4:::::::*
cpe:2.3:a:plone:plone:3.3.2:::::::*
cpe:2.3:a:plone:plone:2.0:::::::*
cpe:2.3:a:plone:plone:3.1.7:::::::*
cpe:2.3:a:plone:plone:2.5.1:::::::*
cpe:2.3:a:plone:plone:2.5.3:::::::*
cpe:2.3:a:plone:plone:3.2.2:::::::*
cpe:2.3:a:plone:plone:2.0.4:::::::*
cpe:2.3:a:plone:plone:2.1.2:::::::*
cpe:2.3:a:plone:plone:1.0.1:::::::*
cpe:2.3:a:plone:plone:3.0.3:::::::*
cpe:2.3:a:plone:plone:3.3.1:::::::*
cpe:2.3:a:plone:plone:3.0.4:::::::*
cpe:2.3:a:plone:plone:2.0.1:::::::*
cpe:2.3:a:plone:plone:2.0.2:::::::*
cpe:2.3:a:plone:plone:3.1.2:::::::*
cpe:2.3:a:plone:plone:3.2.1:::::::*
cpe:2.3:a:plone:plone:1.0.2:::::::*
cpe:2.3:a:plone:plone:2.0.5:::::::*
cpe:2.3:a:plone:plone:3.0.5:::::::*
cpe:2.3:a:plone:plone:2.5:::::::*
cpe:2.3:a:plone:plone:1.0.6:::::::*
cpe:2.3:a:plone:plone:2.5.2:::::::*
cpe:2.3:a:plone:plone:3.0.2:::::::*
cpe:2.3:a:plone:plone:2.1:::::::*
cpe:2.3:a:plone:plone:3.1:::::::*
cpe:2.3:a:plone:plone:3.3.3:::::::*
cpe:2.3:a:plone:plone:2.1.3:::::::*
cpe:2.3:a:plone:plone:3.1.6:::::::*
cpe:2.3:a:plone:plone:3.1.3:::::::*
cpe:2.3:a:plone:plone:1.0.5:::::::*
cpe:2.3:a:plone:plone:2.5.5:::::::*

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2012/11/10/1
2	http://www.openwall.com/lists/oss-security/2012/11/10/1
3	https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
4	https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
5	https://plone.org/products/plone/security/advisories/20121106/12	Vendor Advisory
6	https://plone.org/products/plone/security/advisories/20121106/12	Vendor Advisory
7	https://plone.org/products/plone-hotfix/releases/20121106	Patch
8	https://plone.org/products/plone-hotfix/releases/20121106	Patch