[Zope-dev] SECURITY ALERT and Zope hotfix release [2001-03-08]

[Brian Lloyd]

Hello all -

  An issue has come to our attention (thanks to Randy Kern) that
  necessitates a Zope hotfix. Hotfix products can be installed to
  incorporate modifications to Zope at runtime without requiring
  an immediate installation upgrade. Hotfix products are installed
  just as you would install any other Zope product.

  This hotfix (Hotfix_2001-03-08)addresses an important security issue
  that affects Zope version 2.3.0 and the current 2.3.1 beta 1 release.

  The issue involves an error in the 'aq_inContextOf' method of objects
  that support acquisition. A recent change to the access validation
  machinery made this bug begin to affect security restrictions. The bug,
  with the change to validation, made it possible to access Zope objects
  via acquisition that a user would not otherwise have access to. This
  issue could allow users with enough internal knowledge of Zope to
  perform actions higher in the object hierarchy than they should be able
  to.

  We *highly* recommend that any Zope site running Zope 2.3.0 final or any
  alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product
  installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for
  the issue, at which time the hotfix can be removed. Zope versions prior
  to 2.3.0 are not affected by this issue.

  - http://www.zope.org/Products/Zope/Hotfix_2001-03-08/README.txt

  -
http://www.zope.org/Products/Zope/Hotfix_2001-03-08/Hotfix_2001-03-08.tgz


Brian Lloyd        brian@digicool.com
Software Engineer  540.371.6909
Digital Creations  http://www.digicool.com