---

[Zope] SECURITY ALERT

Date: Tue, 04 Jan 2000 17:12:46 -0500
Subject: [Zope] SECURITY ALERT
From: Christopher Petrilli [email protected]
To: [email protected]

Ok, now that we’ve got your attention…
Thanks to Kevin Littlejohn’s sleuthing, a sizable problem in the
security machinery in DTML has been brought to our attention and
resolved. Without delving too deeply into the obtuseness of the
problem, let me first say that this is 1) very critical, 2) has an
urgent fix.

This problem is of most concern to anyone who opens their Zope
site up to the general public (a’la zope.org) as it could allow
“anonymous” people to do things which are most definitely not
allowed. Unfortunately it was introduced many releases ago, but to
our knowledge this is the first time anyone has discovered this
problem.

Fixes are contained in the CVS repository as well as:

Zope 2.1.2 http://www.zope.org/Products/Zope/2.1.2/

Patch to 1.10.3 http://www.zope.org/Products/Zope/2.1.2/1104_patch.html

It is important to note that the patch to 1.10.3 has some
performance impact on users of this release. Unfortunately, we are
no longer able to provide equal levels of support for users of 1.x
and 2.x implementations of Zope. If there are reasons that your
site is unable to transition to 2.x, please let us know so that we
can work to resolve them in future releases so that we can finally
retire the old 1.x line of code.

If you have any questions regarding the impact to your site of
the changes, please send them to [email protected]

Chris

| Christopher Petrilli – Python Powered – Digital Creations,
Inc.
| [email protected]
http://www.digicool.com