January 2013 - Zope-Dev

Re: [Zope-dev] Bug#692899: zope2.12: [CVE-2012-5485 to 5508] Multiple vectors corrected within 20121106 fix
by Tres Seaver 27 Jan '13

27 Jan '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/27/2013 08:49 AM, Julien Cristau wrote: > On Mon, Nov 26, 2012 at 18:53:58 +0900, Arnaud Fontaine wrote: > >> Tres Seaver <tseaver(a)palladion.com> writes: >> >>>> * CVE-2012-5505 (zope.traversing: atat.py) >>>> http://plone.org/products/plone/security/advisories/20121106/21 >>> >>> That "fix" is also disputed: hiding the "default" view from the >>> '@@' name does not actually improve security at all. There is a >>> Launchpad bug where it is being debated (#1079225), but that >>> bug is still in "Private Security" mode. The correct fix is to >>> change the code of the multi-adapter to barf if published via a >>> URL. >> >> Any idea when this patch will be released? Thanks. >> > Is there any news on that issue? I still believe the report is in error: we cannot hide default (unnamed) views simply because an application might register one in error. Any views which wants not to be called via URLs needs to handle that directly: registering a multiadapter for (IThing, None) *is* registering a view. Tres. - -- =================================================================== Tres Seaver +1 540-429-0999 tseaver(a)palladion.com Palladion Software "Excellence by Design" http://palladion.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlEFTwsACgkQ+gerLs4ltQ6FVACgmfgoLVb+YLTfJCqHEX4cvd+K ywkAn32iTCbw7oCm5EgC7uI60bJiRm1M =mRXV -----END PGP SIGNATURE-----

1 0

zope-tests - FAILED: 1, OK: 17
by Zope tests summarizer 27 Jan '13

27 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-25 00:00:00 UTC and 2013-01-26 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 152 Successful - zopetoolkit_trunk_app - Build # 135 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux [1] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071695.html

1 0

zope-tests - OK: 21
by Zope tests summarizer 26 Jan '13

26 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-24 00:00:00 UTC and 2013-01-25 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 151 Successful - zopetoolkit_trunk_app - Build # 134 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results --------------

2 1

zc.ssl ca chain
by Senner, Talin 25 Jan '13

25 Jan '13

Would someone that has access be able to update zc.ssl and release a new version: http://svn.zope.org/zc.ssl/trunk/src/zc/ssl/certs.pem with a new version of ca root certificates (something say from a latest linux release from /etc/ssl ). The current cert chain is over 5 years old. Thank you! Talin Senner Wildcard Corp. http://www.wildcardcorp.com Secure Web CMS Hosting - CDN - DNS - IPv6 Security.Technology.Solutions

4 5

zope-tests - FAILED: 2, OK: 21
by Zope tests summarizer 25 Jan '13

25 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-23 00:00:00 UTC and 2013-01-24 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 150 Successful - zopetoolkit_trunk_app - Build # 133 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [1] winbot / z3c.recipe.paster_py_265_32 [2] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071673.html [2] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071651.html

2 1

zope-tests - FAILED: 2, OK: 21
by Zope tests summarizer 24 Jan '13

24 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-22 00:00:00 UTC and 2013-01-23 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 149 Successful - zopetoolkit_trunk_app - Build # 132 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [1] winbot / z3c.ptcompat_py_265_32 [2] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.ptcompat_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071628.html [2] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071629.html

1 0

zope-tests - FAILED: 1, OK: 21
by Zope tests summarizer 23 Jan '13

23 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-21 00:00:00 UTC and 2013-01-22 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 148 Successful - zopetoolkit_trunk_app - Build # 131 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [1] winbot / z3c.ptcompat_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.ptcompat_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071606.html

3 3

zope-tests - FAILED: 2, OK: 21
by Zope tests summarizer 22 Jan '13

22 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-20 00:00:00 UTC and 2013-01-21 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 147 Successful - zopetoolkit_trunk_app - Build # 130 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [1] winbot / z3c.ptcompat_py_265_32 [2] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.ptcompat_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071583.html [2] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071605.html

1 0

zope-tests - FAILED: 6, OK: 21
by Zope tests summarizer 21 Jan '13

21 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-19 00:00:00 UTC and 2013-01-20 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 146 Successful - zopetoolkit_trunk_app - Build # 129 [1] Total languishing bugs for zope2: 5 [2] Total languishing bugs for zope: 69 [3] Total languishing bugs for zopeapp: 1 [4] Total languishing bugs for zopetoolkit: 205 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [5] winbot / z3c.ptcompat_py_265_32 [6] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED Total languishing bugs for zope2: 5 https://mail.zope.org/pipermail/zope-tests/2013-January/071560.html [2] FAILED Total languishing bugs for zope: 69 https://mail.zope.org/pipermail/zope-tests/2013-January/071559.html [3] FAILED Total languishing bugs for zopeapp: 1 https://mail.zope.org/pipermail/zope-tests/2013-January/071557.html [4] FAILED Total languishing bugs for zopetoolkit: 205 https://mail.zope.org/pipermail/zope-tests/2013-January/071558.html [5] FAILED winbot / z3c.ptcompat_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071556.html [6] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071582.html

1 0

zope-tests - FAILED: 2, OK: 21
by Zope tests summarizer 20 Jan '13

20 Jan '13

This is the summary for test reports received on the zope-tests list between 2013-01-18 00:00:00 UTC and 2013-01-19 00:00:00 UTC: See the footnotes for test reports of unsuccessful builds. An up-to date view of the builders is also available in our buildbot documentation: http://docs.zope.org/zopetoolkit/process/buildbots.html#the-nightly-builds Reports received ---------------- Successful - zopetoolkit_trunk - Build # 145 Successful - zopetoolkit_trunk_app - Build # 128 Zope-2.10 Python-2.4.6 : Linux Zope-2.11 Python-2.4.6 : Linux Zope-2.12 Python-2.6.8 : Linux Zope-2.13 Python-2.6.8 : Linux Zope-2.13 Python-2.7.3 : Linux Zope-trunk Python-2.6.8 : Linux Zope-trunk Python-2.7.3 : Linux winbot / ZODB_dev py_265_win32 winbot / ZODB_dev py_265_win64 winbot / ZODB_dev py_270_win32 winbot / ZODB_dev py_270_win64 [1] winbot / z3c.ptcompat_py_265_32 [2] winbot / z3c.recipe.paster_py_265_32 winbot / ztk_10 py_254_win32 winbot / ztk_10 py_265_win32 winbot / ztk_10 py_265_win64 winbot / ztk_11 py_254_win32 winbot / ztk_11 py_265_win32 winbot / ztk_11 py_265_win64 winbot / ztk_11 py_270_win32 winbot / ztk_11 py_270_win64 Non-OK results -------------- [1] FAILED winbot / z3c.ptcompat_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071533.html [2] FAILED winbot / z3c.recipe.paster_py_265_32 https://mail.zope.org/pipermail/zope-tests/2013-January/071555.html

1 0