Zope July 2021

zope@zope.dev

2 participants
2 discussions

Zope 4.6.3 and 5.3 released with a security fix
by Jens Vagelpohl 31 Jul '21

31 Jul '21

On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6.3 and 5.3. This bugfix release solves a few minor issues and contains a security fix. For the full list of changes see the change logs at https://zope.readthedocs.io/en/4.x/changes.html#id1 and https://zope.readthedocs.io/en/latest/changes.html#id1 Installation instructions can be found at https://zope.readthedocs.io/en/4.x/INSTALL.html and https://zope.readthedocs.io/en/latest/INSTALL.html. These releases contain a security fix that prevents remote code execution through Script (Python) objects. You are only at risk if all of the following are true: - You use Python 3 for your Zope deployment (Zope 4 on Python 2 is not affected) - You run Zope 4 below version 4.6.3 or Zope 5 below version 5.3 - You have installed the optional Products.PythonScripts add-on package - You allow untrusted non-admin users to add or edit Script (Python) objects By default, untrusted non-admin users cannot add or edit Script (Python) objects, only “Manager” users can. Enabling this level of access for untrusted users would be a very unusual configuration and it is highly unlikely any site administrator would do so to begin with. The related security advisories with full details are published here: - https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j… - https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qc… NOTE FOR PLONE USERS: Make sure to install the latest version of PloneHotfix20210518 first, which should appear shortly after this Zope release. See https://plone.org/security/hotfix/20210518. Don't install Zope 4.6.3 or 5.3 into an existing Plone setup without testing. The PloneHotfix packages ensures that the Zope changes don’t interfere with Plone add-ons. Jens Vagelpohl

1 0

A basic question I couldn't fine the answer on google
by Giampiero Benvenuti 19 Jul '21

19 Jul '21

Hi there, let’s say, I want to upgrade from zope5.1.2 to zope 5.2.1 Should I just replace the zope5.2.1 Data.fs with the zope5.1.2 one? Or, if this sound silly, how would you do it? Thank You, —giampiero

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

Zope July 2021