high7.5
CVE-2009-4405
Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils
Impact
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | trac | < 0.11.6 | 0.11.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Edgewall | Trac | through 0.11.5 Versions 0.5, 0.5.1, 0.5.2, 0.6, 0.6.1 |
References
- NVD record
- CVE.org record
- GitHub advisory
- http://secunia.com/advisories/37807
- http://secunia.com/advisories/37901
- http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE
- http://www.vupen.com/english/advisories/2009/3615
- https://bugzilla.redhat.com/show_bug.cgi?id=542394
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54983
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01169.html
- https://github.com/advisories/GHSA-f9qv-j5g6-g5cr
- https://nvd.nist.gov/vuln/detail/CVE-2009-4405
- https://web.archive.org/web/20130417170303/http://secunia.com/advisories/37901
- https://web.archive.org/web/20130513235205/http://secunia.com/advisories/37807
- https://github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2009-7.yaml