[Zope-Annce] SECURITY alert and hotfix release
Chris McDonough
chrism@digicool.com
Tue, 1 May 2001 15:29:25 -0400
Hello All,
Dieter Maurer uncovered a potential security issue yesterday that
necessitated a hotfix release.
This hotfix addresses an important security issue that affects Zope
versions up to and including Zope 2.3.2.
The issue is related to ZClasses in that any user can visit a ZClass
declaration and change the ZClass permission mappings for methods
and other objects defined within the ZClass, possibly allowing
for unauthorized access within the Zope instance.
We *highly* recommend that any Zope site running versions of
Zope up to and including 2.3.2 have this hotfix product installed
to mitigate this issue.
- http://www.zope.org/Products/Zope/Hotfix_2001-05-01/README.txt
-
http://www.zope.org/Products/Zope/Hotfix_2001-05-01/Hotfix_2001-05-01.tgz