Hello, a security issue with the Docutils package coming with Zope 2.6 or higher has been discovered. Sites that expose reStructuredText functionality to untrusted users (typically portal sites allowing registered users to edit content) are possibly affected. Download location and installation are available from http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert The hotfix is supposed to work with any Zope 2.7 and 2.8 version. It might work for Zope 2.6 and Python 2.1 but we can not give a guarantee since Zope 2.6 is no longer maintained. Plone sites do not seem to be affected (there seems to be some additional code on top of Zope's reST implementation avoiding the failure) however this not a guarantee. The upcoming Zope 2.8.2 and 2.7.8 releases will also ship with the hotfix. Andreas Jung
Andreas Jung schrieb:
Hello,
a security issue with the Docutils package coming with Zope 2.6 or higher has been discovered. Sites that expose reStructuredText functionality to untrusted users (typically portal sites allowing registered users to edit content) are possibly affected.
Download location and installation are available from
http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert
The hotfix is supposed to work with any Zope 2.7 and 2.8 version. It might work for Zope 2.6 and Python 2.1 but we can not give a guarantee since Zope 2.6 is no longer maintained. Plone sites do not seem to be affected (there seems to be some additional code on top of Zope's reST implementation avoiding the failure) however this not a guarantee. The upcoming Zope 2.8.2 and 2.7.8 releases will also ship with the hotfix.
Where are the details on the nature of the security problem?
Aloha, I just applied the below hotfix as directed to a zope 2.7.5 installation on my development machine. It broke something bad, now the browser just says The connection was refused when attempting to contact localhost:9673 I cannot access the ZMI nor any site pages, not on localhost:9673 nor on 127.0.0.1:9673 That is the port it was installed and had been working on. I did nothing but install the hotfix as directed on the linked page below. I have completely restarted the machine. At boot time the messages indicate that zope started fine, as usual. Any help appreciated, the sooner the better. thanks, John S. --- Andreas Jung <lists@andreas-jung.com> wrote:
Hello,
a security issue with the Docutils package coming with Zope 2.6 or higher has been discovered. Sites that expose reStructuredText functionality to untrusted users (typically portal sites allowing registered users to edit content) are possibly affected.
Download location and installation are available from
http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert
The hotfix is supposed to work with any Zope 2.7 and 2.8 version. It might work for Zope 2.6 and Python 2.1 but we can not give a guarantee since Zope 2.6 is no longer maintained. Plone sites do not seem to be
affected (there seems to be some additional code on top of Zope's reST implementation avoiding the failure) however this not a guarantee. The upcoming Zope 2.8.2 and 2.7.8 releases will also ship with the hotfix.
Andreas Jung
_______________________________________________ Zope-Announce maillist - Zope-Announce@zope.org http://mail.zope.org/mailman/listinfo/zope-announce
Zope-Announce for Announcements only - no discussions
(Related lists - Users: http://mail.zope.org/mailman/listinfo/zope Developers: http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/
r --On 10. Oktober 2005 20:21:10 -0700 John Schinnerer <johnschinnerer@yahoo.com> wrote:
Aloha,
I just applied the below hotfix as directed to a zope 2.7.5 installation on my development machine.
It broke something bad, now the browser just says
The connection was refused when attempting to contact localhost:9673
I cannot access the ZMI nor any site pages, not on localhost:9673 nor on 127.0.0.1:9673
That is the port it was installed and had been working on. I did nothing but install the hotfix as directed on the linked page below.
I have completely restarted the machine. At boot time the messages indicate that zope started fine, as usual.
When Zope does not respond to requests as stated then there has been something during the startup phase of phase. I do not believe that the patch causes a startup problem. If it does then you applied it the wrong way or you are not telling us all details in terms of error messages happening during startup. -aj
Aloha, Well, according to a comment on the hotfix page on problems with applying it to 2.7.0, which was posted after I had already killed my 2.7.5 by applying it, there are some issues which might break it on/during startup, such as config file items expected but not present for at least one of the affected products, perms issues, etc. JohnS. --- Andreas Jung <lists@andreas-jung.com> wrote:
--On 10. Oktober 2005 20:21:10 -0700 John Schinnerer <johnschinnerer@yahoo.com> wrote:
Aloha,
I just applied the below hotfix as directed to a zope 2.7.5 installation on my development machine.
It broke something bad, now the browser just says
The connection was refused when attempting to contact localhost:9673
I cannot access the ZMI nor any site pages, not on localhost:9673 nor on 127.0.0.1:9673
That is the port it was installed and had been working on. I did nothing but install the hotfix as directed on the linked page below.
I have completely restarted the machine. At boot time the messages indicate that zope started fine, as usual.
When Zope does not respond to requests as stated then there has been something during the startup phase of phase. I do not believe that the patch causes a startup problem. If it does then you applied it the wrong way or you are not telling us all details in terms of error messages happening during startup.
-aj
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com
Aloha, FWIW here's what I found while backing out the hotfix on my zope 2.7.5: The hotfix-installed files are set to an owner, group and perms that do not work with an existing install (zope fails to start up completely/correctly). I don't know if there are other problems also, but that was the relevant issue for me. More importantly, and more annoyingly for trying to back out, the owner, group and perms for the Products folder is altered to the same dysfunctional settings! I use debian, so I simply tried to reinstall the zope2.7 debian package to get the pre-hotfix files back. First I got some explicit errors on the hotfix-installed files that pointed me to the owner/group/perms problems with those. Then the debian package *appeared* to install, but zope still failed to actually start once installed and configured. It took me a while to notice that the owner/group/perms on the Products folder itself had been changed to the same settings, blocking correct/complete reinstall of the original files. Unfortunately the package install didn't raise any errors on this. Once I fixed the messed-up perms on the Products folder and did the install again, all was well. I put this info on the hotfix alert comments also. John S. --- John Schinnerer <johnschinnerer@yahoo.com> wrote:
Aloha,
I just applied the below hotfix as directed to a zope 2.7.5 installation on my development machine.
It broke something bad, now the browser just says
The connection was refused when attempting to contact localhost:9673
I cannot access the ZMI nor any site pages, not on localhost:9673 nor on 127.0.0.1:9673
That is the port it was installed and had been working on. I did nothing but install the hotfix as directed on the linked page below.
I have completely restarted the machine. At boot time the messages indicate that zope started fine, as usual.
Any help appreciated, the sooner the better.
thanks, John S.
--- Andreas Jung <lists@andreas-jung.com> wrote:
Hello,
a security issue with the Docutils package coming with Zope 2.6 or higher has been discovered. Sites that expose reStructuredText functionality to untrusted users (typically portal sites allowing registered users to edit content) are possibly affected.
Download location and installation are available from
http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert
The hotfix is supposed to work with any Zope 2.7 and 2.8 version. It might work for Zope 2.6 and Python 2.1 but we can not give a guarantee since Zope 2.6 is no longer maintained. Plone sites do not seem to
be
affected (there seems to be some additional code on top of Zope's reST implementation avoiding the failure) however this not a guarantee. The upcoming Zope 2.8.2 and 2.7.8 releases will also ship with the hotfix.
Andreas Jung
_______________________________________________ Zope-Announce maillist - Zope-Announce@zope.org http://mail.zope.org/mailman/listinfo/zope-announce
Zope-Announce for Announcements only - no discussions
(Related lists - Users: http://mail.zope.org/mailman/listinfo/zope Developers: http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/ _______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com
The trick is to do something like this which is what I did: $ cd /usr/lib/zope-2.7.5/lib/python/ $ wget http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert/Hotfix_20... $ tar -zxvf Hotfix_2005-10-09.tar.gz $ chmod -R 644 . $ chmod -R +X . That's on a debian to. YMMV. 2005/10/13, John Schinnerer <johnschinnerer@yahoo.com>:
Aloha,
FWIW here's what I found while backing out the hotfix on my zope 2.7.5:
The hotfix-installed files are set to an owner, group and perms that do not work with an existing install (zope fails to start up completely/correctly). I don't know if there are other problems also, but that was the relevant issue for me.
More importantly, and more annoyingly for trying to back out, the owner, group and perms for the Products folder is altered to the same dysfunctional settings!
I use debian, so I simply tried to reinstall the zope2.7 debian package to get the pre-hotfix files back. First I got some explicit errors on the hotfix-installed files that pointed me to the owner/group/perms problems with those.
Then the debian package *appeared* to install, but zope still failed to actually start once installed and configured.
It took me a while to notice that the owner/group/perms on the Products folder itself had been changed to the same settings, blocking correct/complete reinstall of the original files.
Unfortunately the package install didn't raise any errors on this.
Once I fixed the messed-up perms on the Products folder and did the install again, all was well.
I put this info on the hotfix alert comments also.
John S.
--- John Schinnerer <johnschinnerer@yahoo.com> wrote:
Aloha,
I just applied the below hotfix as directed to a zope 2.7.5 installation on my development machine.
It broke something bad, now the browser just says
The connection was refused when attempting to contact localhost:9673
I cannot access the ZMI nor any site pages, not on localhost:9673 nor on 127.0.0.1:9673
That is the port it was installed and had been working on. I did nothing but install the hotfix as directed on the linked page below.
I have completely restarted the machine. At boot time the messages indicate that zope started fine, as usual.
Any help appreciated, the sooner the better.
thanks, John S.
--- Andreas Jung <lists@andreas-jung.com> wrote:
Hello,
a security issue with the Docutils package coming with Zope 2.6 or higher has been discovered. Sites that expose reStructuredText functionality to untrusted users (typically portal sites allowing registered users to edit content) are possibly affected.
Download location and installation are available from
http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert
The hotfix is supposed to work with any Zope 2.7 and 2.8 version. It might work for Zope 2.6 and Python 2.1 but we can not give a guarantee since Zope 2.6 is no longer maintained. Plone sites do not seem to
be
affected (there seems to be some additional code on top of Zope's reST implementation avoiding the failure) however this not a guarantee. The upcoming Zope 2.8.2 and 2.7.8 releases will also ship with the hotfix.
Andreas Jung
_______________________________________________ Zope-Announce maillist - Zope-Announce@zope.org http://mail.zope.org/mailman/listinfo/zope-announce
Zope-Announce for Announcements only - no discussions
(Related lists - Users: http://mail.zope.org/mailman/listinfo/zope Developers: http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/ _______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
__________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com _______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
-- Peter Bengtsson, work www.fry-it.com home www.peterbe.com hobby www.issuetrackerproduct.com
participants (4)
-
Andreas Jung -
John Schinnerer -
Peter Bengtsson -
Tino Wildenhain