urgent Zope 2.12 / 2.13 hotfix!

Dear ZMS users,


yesterday morning i found a new and serious security hole on Zope 2.12 
(<=2.12.20) and 2.13 (<=2.13.6 vs <=2.13.10) and (unfortunately, sorry for 
that) i posted that on a non-security related (public) zope mailing list.

The ZOPE team released an hotfix yesterday evening:
http://permalink.gmane.org/gmane.comp.web.zope.announce/1510

Especially (nut not only) for ZMS users in "typical scenarios" this security 
bug could lead to search engine results which directly point to very (!) 
sensitive Zope / ZMS ressources. 

As a result even users without the knowledge of or anything about the security 
hole (and about ZOPE) was able to get / could get remote access to the full 
ZMS / ZOPE system relatively easily i.e. just by search engines / randomnes.

As the ZOPE team byself did not published any further details about the 
security hole until now i give no more details here publically for now.


cheers,


Niels.

-- 
---
Niels Dettenbach
Syndicat IT&Internet
http://www.syndicat.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAABCAAGBQJOpnApAAoJEM78prARigUnGgMP/3M77F6Ix17Jl0syzeK/S4TD
C2GwEPGgztRGZBLBbXaT7o94FkAFkTch6n62i0LlPk3s3HumlAslG3CGOHeoDKrN
wlvfAS83pIc/Ea22jyESjK9+zCHop/eCecyGgPp6K1/NnxlBH4V5Kcne9kJEUCXr
fsBtlmAHcyyBtbqPaC9KDlaj9EE6vnqXrWHiZ7mdLmTm4SH6BEkxUX3Cu0efptbE
2kYSgbs0agQaQ0x7M4AxB5uG/W88sYuhGuLAdOTHAmjXM8u5PzWhPxuU/5bTxXV4
lRszdJcLi8W+bDCL7JVz/PMoRB9+53h4dwXLubtyrskkDB/zM6A4xnRj8wOw4run
8VjCUmu5+j2/bFIpnl8uXBbOxcFHhjEmwnXonuSt+ZI3n7L2i/OBfBSKKSmYpGmG
eqOGbZKxBXMUjRXhEswTyJ/pBb/MSAf2y+wGw24UEtoIm0501HRPOKvQCbsRvBgS
GnL30kIYCEvML/Kyg2oYZ52X/gEYr9eo+VvbT8hvEAgPRCb1COPmQyKuYBN7/cB2
RUX78eyNBkuWgxZTDZY9tTrhxgqb7O2/IVtT5LC/dnAiU1qzhnhWYn4V96o660oo
9cGjm3SuZcfil7Bw3zEgxHABwDLLABw3GRta8ul0hlwvMI2/NIlMoPgqeOly7eMG
RU2S21kikDMrx5cLOW4J
=2RGh
-----END PGP SIGNATURE-----