- Zope-Announce - Zope lists

Zope 4.8 and 5.5 released
by Jens Vagelpohl 10 Mar '22

10 Mar '22

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.8 and 5.5. These releases add improved cookie handling (see https://github.com/zopefoundation/Zope/pull/1010) in addition to a few bug fixes. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1. Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0

Zope 4.7 and 5.4 released
by Jens Vagelpohl 09 Jan '22

09 Jan '22

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.7 and 5.4. These bugfix releases solve a few issues with object creation via WebDAV and a few ZMI page issues. Zope 5.4 officially deprecates the PropertyManager property types ulines, utext, utoken and ustring and will show a warning in the ZMI when these are encountered. A function was added at ``ZPublisher.utils.fix_properties`` which will replace all these properties with their standard equivalents, see https://github.com/zopefoundation/Zope/pull/993 for a usage example. Due to ongoing domain ownership issues with the zope.org domain we are deprecating it in favor of the new domain zope.dev. All hosts and email addresses that used to live under zope.org are now reachable under zope.dev. These new Zope releases and the documentation at https://zope.readthedocs.io and https://www.zope.dev had all URLs and references updated to reflect this change. Finding and changing old references will take time, though. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1. Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0

Zope 4.6.3 and 5.3 released with a security fix
by Jens Vagelpohl 31 Jul '21

31 Jul '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6.3 and 5.3. This bugfix release solves a few minor issues and contains a security fix. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. These releases contain a security fix that prevents remote code execution through Script (Python) objects. You are only at risk if all of the following are true: - You use Python 3 for your Zope deployment (Zope 4 on Python 2 is not affected) - You run Zope 4 below version 4.6.3 or Zope 5 below version 5.3 - You have installed the optional Products.PythonScripts add-on package - You allow untrusted non-admin users to add or edit Script (Python) objects By default, untrusted non-admin users cannot add or edit Script (Python) objects, only “Manager” users can. Enabling this level of access for untrusted users would be a very unusual configuration and it is highly unlikely any site administrator would do so to begin with. The related security advisories with full details are published here: - https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j… - https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qc… NOTE FOR PLONE USERS: Make sure to install the latest version of PloneHotfix20210518 first, which should appear shortly after this Zope release. See https://plone.org/security/hotfix/20210518. Don't install Zope 4.6.3 or 5.3 into an existing Plone setup without testing. The PloneHotfix packages ensures that the Zope changes don’t interfere with Plone add-ons. Jens Vagelpohl

1 0

Zope 4.6.2 released
by Jens Vagelpohl 27 Jun '21

27 Jun '21

On behalf of Zope developer community I am pleased to announce the release of Zope 4.6.2. This bugfix release backports the stricter path expression traversal code from Zope 5. For the full list of changes see the change log at https://zope.readthedocs.io/en/4.x/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html NOTE FOR PLONE USERS: Make sure to install the latest version of PloneHotfix20210518 first, which should appear shortly after this Zope release. See https://plone.org/security/hotfix/20210518. Don't install Zope 4.6.2 into an existing Plone setup without testing. The traversal changes in Zope break some Plone add-ons that relied on the old traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. Jens Vagelpohl

1 0

Zope 4.6.1 and 5.2.1 released with an important security fix
by Jens Vagelpohl 08 Jun '21

08 Jun '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6.1 and 5.2.1. This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. NOTE: These releases contain an expanded security fix that prevents remote code execution through TAL expressions. The first iteration of the security fix in Zope 4.6 and 5.2 did not catch all cases of unauthorized TAL path expression traversal. Just like the first fix, you will only ever be at risk if you allow untrusted users to add or edit Zope Page Template objects, which is a very unusual non-standard site configuration. For more details, see the security advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2…. A CVE has been requested through GitHub. NOTE FOR PLONE USERS: Make sure to install the latest version of PloneHotfix20210518 first, which should appear shortly after this Zope release. See https://plone.org/security/hotfix/20210518. Don't install Zope 4.6.1 or 5.2.1 into an existing Plone setup without testing. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. Jens Vagelpohl

1 0

Re: [Zope-Annce] [Zope] Zope 4.6 and 5.2 released with an important security fix
by Jens Vagelpohl 21 May '21

21 May '21

Hi Jürgen, Zope and Plone are still two different projects. The Plone developers published a hotfix product that fixes everything they believe needed to be fixed. I looked at items that apply to plain Zope and made the required changes in Zope. So anyone using plain Zope can install the latest update and they are safe. As a plain Zope developer I cannot comment on or make recommendations regarding a Plone hotfix, and Zope itself will never require a Plone add-on or hotfix. I don’t have any control over how the Plone release managers communicate these fixes, either. People who do not use Plone are advised to stick to published Zope updates. jens > On 21. May 2021, at 12:25 , Jürgen Gmach <juergen.gmach(a)apis.de> wrote: > > Thank you very much for the fix and the new release. > > As a user of plain Zope, and having already applied PloneHotfix20210518, I wonder whether I need or should deinstall the hotfix now. > > e.g. the hotfix also touched xmlrpc, which this new release does not. > > Or let me rephrase my question. > > What is the current recommended way to mitigate the announced vulnerabilities for a plain Zope setup? > > Install the just released Zope version and the hotfix? Or just the latest Zope version? > > Thank you! > Von: Zope <zope-bounces(a)zope.org> im Auftrag von Jens Vagelpohl <jens(a)netz.ooo> > Gesendet: Freitag, 21. Mai 2021 11:12 > An: zope-announce(a)zope.org <zope-announce(a)zope.org>; zope(a)zope.org Users <zope(a)zope.org> > Betreff: [Zope] Zope 4.6 and 5.2 released with an important security fix > > On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6 and 5.2. > > This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs athttps://zope.readthedocs.io/en/4.x/changes.html#id1 andhttps://zope.readthedocs.io/en/latest/changes.html#id1 > > Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. > > NOTE: These releases contain a security fix that prevents remote code execution through TAL expressions. You will only be at risk if you allow untrusted people to add or edit Zope Page Template objects. For more details, see the security advisory athttps://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234…. A CVE has been requested through GitHub. > > NOTE FOR PLONE USERS: Before installing Zope 4.6 or 5.2 make sure to install PloneHotfix20210518 first, see https://plone.org/security/hotfix/20210518. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. > > Jens Vagelpohl > > _______________________________________________ > Zope maillist - Zope(a)zope.org > https://mail.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > https://mail.zope.org/mailman/listinfo/zope-announce > https://mail.zope.org/mailman/listinfo/zope-dev )

1 0

Zope 4.6 and 5.2 released with an important security fix
by Jens Vagelpohl 21 May '21

21 May '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6 and 5.2. This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. NOTE: These releases contain a security fix that prevents remote code execution through TAL expressions. You will only be at risk if you allow untrusted people to add or edit Zope Page Template objects. For more details, see the security advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-j…. A CVE has been requested through GitHub. NOTE FOR PLONE USERS: Before installing Zope 4.6 or 5.2 make sure to install PloneHotfix20210518 first, see https://plone.org/security/hotfix/20210518. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone add-ons. Jens Vagelpohl

1 0

Zope 4.5.5 and 5.1.2 released
by Jens Vagelpohl 02 Mar '21

02 Mar '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.5.5 and 5.1.2. This bugfix release solves a few minor issues and improves security checking for some types of XML-RPC requests. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0

Two low-impact security issues in Products.PluggableAuthService
by Jens Vagelpohl 26 Feb '21

26 Feb '21

Hi all, Two low-impact security issues have been identified in Products.PluggableAuthService: - an information disclosure issue involving the ZODB Role Manager plugin. See https://github.com/zopefoundation/Products.PluggableAuthService/security/ad… for details. - an open redirect issue in the Cookie Auth Helper. See https://github.com/zopefoundation/Products.PluggableAuthService/security/ad… for details. Both issues are mitigated by updating to Products.PluggableAuthService version 2.6.1 or higher. The Plone release managers will apply this update with Plone bugfix releases they are planning to publish within the next few days. jens

1 0

Zope 4.5.4 and 5.1.1 released
by Jens Vagelpohl 10 Feb '21

10 Feb '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.5.4 and 5.1.1. This bugfix release solves a few minor issues and updates the shipped versions of bootstrap, jQuery and Font Awesome to their latest releases. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. Jens Vagelpohl

1 0