Is CVE-2010-3198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2010-3198 being exploited in the wild.

How severe is CVE-2010-3198?

High severity, with a CVSS score of 7.5, published 17 May 2022.

Which products and versions are affected?

Zope (PyPI) ECOSYSTEM:introduced=2.10.0,fixed=2.10.12, ECOSYSTEM:introduced=2.10.0,fixed=2.10.12,introduced=2.11.0,fixed=2.11.7.

Is there a fix for CVE-2010-3198?

Yes. Zope (PyPI): upgrade to 2.10.12, 2.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2010-3198 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2010-3198?

Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2010-3198: Zope ZServer denial of service via worker thread crash

CVE-2010-3198 · Severity: high · CVSS 7.5 · Published 2022-05-17

A vulnerability in the ZServer component of the Zope web application server allows remote attackers to crash the server's worker threads. By sending specifically crafted web requests that trigger unhandled errors, an attacker can exhaust the server's processing capacity. This results in a denial of service where the application remains running but becomes unresponsive to legitimate users.

Technologies: Zope (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2010-3198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2010-3198 being exploited in the wild.
How severe is CVE-2010-3198?: High severity, with a CVSS score of 7.5, published 17 May 2022.
Which products and versions are affected?: Zope (PyPI) ECOSYSTEM:introduced=2.10.0,fixed=2.10.12, ECOSYSTEM:introduced=2.10.0,fixed=2.10.12,introduced=2.11.0,fixed=2.11.7.
Is there a fix for CVE-2010-3198?: Yes. Zope (PyPI): upgrade to 2.10.12, 2.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-3198 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2010-3198?: Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Zope (PyPI): upgrade to 2.10.12, 2.11.7 or later
```
pip install "Zope>=2.11.7"
```

Technical details

The ZServer component in Zope versions 2.10.x (before 2.10.12) and 2.11.x (before 2.11.7) lacks a global exception handler for its worker threads. An unauthenticated remote attacker can exploit this by sending requests that trigger uncaught exceptions—for example, by providing malformed list parameters to certain authentication plugins like CookieAuthHelper. When an exception occurs during publication and is not caught, the individual worker thread terminates. By repeating this process, an attacker can kill all available worker threads, leading to a complete denial of service. The issue was resolved by backporting a catch-all exception handler from Zope 2.12.

Affected products

Zope Foundation Zope >= 2.10.0, < 2.10.12; >= 2.11.0, < 2.11.7

Identifiers

CVE-2010-3198
GHSA-qh4q-fwf8-qqrw
PYSEC-2010-32
PYSEC-2010-33

Timeline

2010-09-01: patched: Fixes committed to 2.10 and 2.11 branches and releases announced.
2010-09-08: advisory: NVD published CVE-2010-3198.
2022-05-17: advisory: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.