Zope SECURITY ALERT and Zope hotfix release

Date: Fri, 9 Mar 2001 12:50:31 -0500
From: Brian Lloyd brian@digicool.com
To: zope-announce@zope.org, zope@zope.org, zope-dev@zope.org
Subject: [Zope-Annce] SECURITY ALERT and Zope hotfix release
[2001-03-08]

Hello all –

An issue has come to our attention (thanks to Randy Kern) that
necessitates a Zope hotfix. Hotfix products can be installed to
incorporate modifications to Zope at runtime without requiring an
immediate installation upgrade. Hotfix products are installed just
as you would install any other Zope product.

This hotfix (Hotfix_2001-03-08)addresses an important security
issue that affects Zope version 2.3.0 and the current 2.3.1 beta 1
release.

The issue involves an error in the ‘aq_inContextOf’ method of
objects that support acquisition. A recent change to the access
validation machinery made this bug begin to affect security
restrictions. The bug, with the change to validation, made it
possible to access Zope objects via acquisition that a user would
not otherwise have access to. This issue could allow users with
enough internal knowledge of Zope to perform actions higher in the
object hierarchy than they should be able to.

We *highly* recommend that any Zope site running Zope 2.3.0
final or any alpha or beta version of 2.3.0 or 2.3.1 beta 1 have
this hotfix product installed to mitigate the issue. Zope 2.3.1
beta 2 will contain a fix for the issue, at which time the hotfix
can be removed. Zope versions prior to 2.3.0 are not affected by
this issue.

– http://www.zope.org/Products/Zope/Hotfix_2001-03-08/README.txt

–
http://www.zope.org/Products/Zope/Hotfix_2001-03-08/Hotfix_2001-03-08.tgz

Brian Lloyd        brian@digicool.com
Software Engineer  540.371.6909
Digital Creations  http://www.digicool.com