- Zope-Announce - Zope lists

MailingLogger 3.7.0 Released!
by Chris Withers 18 Jan '12

18 Jan '12

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested This release fixes a long standing bug that occurred when logging unicode messages. It also provides support for sending colourised HTML emails: http://packages.python.org/mailinglogger/html.html Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

MailingLogger 3.6.0 Released!
by Chris Withers 25 Nov '11

25 Nov '11

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested The only change for this release is to allow summaries sent by SummarisingLogger to contain messages logged at a lower level than those which triggered the summary to be emailed. Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

Hotfix for security vulnerability
by Tres Seaver 24 Oct '11

24 Oct '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Zope security response team, I would like to announce the availability of a hotfix for a vulnerability inadvertently published earlier today. 'Products.Zope_Hotfix_20111024' README ====================================== Overview - -------- This hotfix addresses a serious vulnerability in the Zope2 application server. Affected versions of Zope2 include: - - 2.12.x <= 2.12.20 - - 2.13.x <= 2.13.6 Older releases (2.11.x, 2.10.x, etc.) are not vulnerable. The Zope2 security response team recommends that all users of these releases upgrade to an unaffected release (2.12.21 or 2.13.11) as soon as they become available. Until that upgrade is feasible, deploying this hotfix also mitigates the vulnerability. Installing the Hotfix: Via 'easy_install' - ------------------------------------------- If the Python which runs your Zope instance has 'setuptools' installed (or is a 'virtualenv'), you can install the hotfix directly from PyPI:: $ /prefix/bin/easy_install Products.Zope_Hotfix_20111024 and then restart the Zope instance, e.g.: $ /path/to/instance/bin/zopectl restart Installing the Hotfix: Via 'zc.buildout' - ----------------------------------------- If your Zope instance is managed via 'zc.buildout', you can install the hotfix directly from PyPI. Edit the 'buildout.cfg' file, adding "Products.Zope_Hotfix_20111024" to the "eggs" section of the instance. E.g.:: [instance] recipe = plone.recipe.zope2instance #... eggs = ${buildout:eggs} Products.Zope_Hotfix_20111024 Next, re-run the buildout:: $ /path/to/buildout/bin/buildout and then restart the Zope instance, e.g.: $ /path/to/buildout/bin/instance restart Installing the Hotfix: Manual Installation - ------------------------------------------- You may also install this hotfix manually. Download the tarball from the PyPI page: http://pypi.python.org/pypi/Products.Zope_Hotfix_20111024 Unpack the tarball and add a 'products' key to the 'etc/zope.conf' of your instance. E.g.:: products /path/to/Products.Zope_Hotfix_20111024/Products and restart. Verifying the Installation - -------------------------- After restarting the Zope instance, check the 'Control_Panel/Products' folder in the Zope Management Interface, e.g.: http://localhost:8080/Control_Panel/Products/manage_main You should see the 'Zope_Hotfix_20111024' product folder there. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6l3pQACgkQ+gerLs4ltQ66AgCfT1cd94LXzBtdzNiBqKXnGBIF 7dwAoISO0AkuvERn+cw4W0cPo82c5r+D =xRBY -----END PGP SIGNATURE-----

1 0

Security vulnerabiity 20110928: Arbitrary Code Execution (pre-announcement)
by Tres Seaver 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Zope security response team is pre-announcing a fix for a vulnerability in Zope 2.12.x and Zope 2.13.x that allows execution of arbitrary code by anonymous users. This is a severe vulnerability that allows an unauthenticated attacker to employ a carefully crafted web request to execute arbitrary commands with the privileges of the Zope service. Versions Affected: Zope 2.12.x and Zope 2.13.x. Versions Not Affected: Zope 2.9.x, Zope 2.10.x, Zope 2.11.x This is a pre-announcement. Due to the severity of this issue we are providing an advance warning of an upcoming patch, which will be released 2011-10-04 15:00 UTC. What you should do in advance of patch availability =================================================== Due to the nature of the vulnerability, the security team has decided to pre-announce that a fix is upcoming before disclosing the details. This is to ensure that concerned users can plan around the release. As the fix being published will make the details of the vulnerability public, we are recommending that all users plan a maintenance window for 30 minutes either side of the announcement where your site is completely inaccessible in which to install the fix. Meanwhile, we STRONGLY recommend that you take the following steps to protect your site: - - Make sure that the Zope service is running with with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories. - - Use an intrusion detection system that monitors key system resources for unauthorized changes. - - Monitor your Zope, reverse-proxy request and system logs for unusual activity. In this case, these are standard precautions that should be employed on any production system. Extra help ========== Should you not have in-house server administrators or a service agreement looking after your website you can find consultancy companies on plone.net. There is also free support available online via Zope mailing lists and the #zope IRC channels. Questions and Answers ===================== Q: When will the patch be made available? A: The Security Team will release the patch at 2011-10-04 15:00 UTC. Q. What will be involved in applying the patch? A. Patches are made available as tarball-style archives that may be unpacked into the “products” folder of a buildout installation and as Python packages that may be installed by editing a buildout configuration file and running buildout. Patching is generally easy and quick to accomplish. Q: How was this vulnerability found? A: This issue was found as part of a routine audit performed by the Plone Security team. Q: My site is highly visible and mission-critical. I hear the patch has already been developed. Can I get the fix before the release date? A: No. The patch will be made available to all users at the same time. There are no exceptions. Q: If the patch has been developed already, why isn't it already made available to the public? A: The Security Team is still testing the patch and running various scenarios thoroughly. The team is also making sure everybody has appropriate time to plan to patch their Zope installation(s). Some consultancy organizations have hundreds of sites to patch and need the extra time to coordinate their efforts with their clients. Q: How does one exploit the vulnerability? A: This information will not be made available until after the patch is made available. Q: Is there a CVE record for this vulnerability? A: Not yet. This information will be added when available. If you have specific questions about this vulnerability or its handling, contact the Zope Security Team, security-response(a)zope.org. To report potentially security-related issues, please send a mail to the Zope Security Team at security-response(a)zope.org. The security team is always happy to credit individuals and companies who make responsible disclosures. Information for vulnerability database maintainers ================================================== CVSS Base Score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P/E:P/RL:O/RC:C) Impact Subscore 6.4 Exploitability Subscore 10 CVSS Temporal Score 5.9 Credit Alan Hoey Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6DlaMACgkQ+gerLs4ltQ7D+gCgz6WA6J44vxkhjnJGquBzCR33 nPgAn3cl0/do5VB+B6h9WmM22yIGOb7Z =/HcQ -----END PGP SIGNATURE-----

1 0

MailingLogger 3.5.0 Released!
by Chris Withers 24 Sep '11

24 Sep '11

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested The only change for this release was to add an X-Log-Level header to emails sent. For MailingLogger, this is the level of the log message being emailed. For SummarisingLogger this is the highest level of any of the messages handled. Full docs can be found here: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 0

MailingLogger 3.4.0 Released!
by Chris Withers 22 Aug '11

22 Aug '11

I'm pleased to announce a new release of Mailinglogger. Mailinglogger provides two handlers for the standard python logging framework that enable log entries to be emailed either as the entries are logged or as a summary at the end of the running process. The handlers have the following features: - customisable and dynamic subject lines for emails sent - emails sent with a configurable headers for easy filtering - flood protection to ensure the number of emails sent is not excessive - support for SMTP servers that require authentication - fully documented and tested This release has no functional changes but finally ships with a full new set of Sphinx docs: http://packages.python.org/mailinglogger/ For more information, please see: http://www.simplistix.co.uk/software/python/mailinglogger or http://pypi.python.org/pypi/mailinglogger cheers, Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk

1 1

www.zope.org relaunched
by Andreas Jung 07 Jul '11

07 Jul '11

Dear Zope Community, on behalf of the Zope Foundation I please to announce the relaunch of the new www.zope.org web site. http://www.zope.org The "old" zope.org site will available for the time being in (reduced form) under http://old.zope.org Many thanks to my team: - Kai Mertens - Michael Haubenwaller - Jens Vagelpohl - Johannes Raggam Andreas Jung Zope Foundation

1 0

www.zope.org relaunch on Thursday
by Andreas Jung 04 Jul '11

04 Jul '11

Hi there, www.zope.org will be relaunched this Thursday. The current www.zope.org will be moved old.zope.org and replaced with the new site. During the DNS transition and while working on the sites you may encounter outages. The transition will start on Thursday (Germany) morning. Andreas

1 0

Security Hotfix 20110622 released
by Laurence Rowe 28 Jun '11

28 Jun '11

Last week, the Zope and Plone security teams announced the discovery of a serious security issue affecting all recent versions of Zope and Plone, as well as the planned release of a Hotfix to address this issue to be made today, June 28th at 1500 UTC. The Plone and Zope security teams are announcing that this security hotfix is now available for download. For full instructions on how to get and install the Hotfix, go here: http://plone.org/products/plone-hotfix/releases/20110622 To find out more about the details of the issue, answers to common questions and which versions of Zope and Plone are affected, please see: http://plone.org/products/plone/security/advisories/20110622 Assistance in installing this hotfix is available free of charge via IRC in #plone-tuneup. If you don't have in-house server administrators or a service agreement supporting your website, you can find consultancy companies under the providers section of Plone.org - http://plone.org/support/network On behalf of the Zope and Plone security teams, Laurence

1 0

Security announcement update
by Laurence Rowe 28 Jun '11

28 Jun '11

This is an update on today's security hotfix release. The fix will be released at 15:00 UTC today, Tuesday 28th June, 2011 (11:00am US EDT.) Updated versions of Zope 2 containing the security fix will be released at the same time. For details on which versions of Zope and Plone are affected, please see: http://plone.org/products/plone/security/advisories/20110622 For installation instructions, please see: http://plone.org/products/plone-hotfix/releases/20110622 On behalf of the Zope and Plone security teams, Laurence

1 0