Two low-impact security issues in Products.PluggableAuthService

--===============4036305243998093974==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_BFEEB2F8-5BE8-48FD-B915-8889E562E8D2";
	protocol="application/pgp-signature";
	micalg=pgp-sha512


--Apple-Mail=_BFEEB2F8-5BE8-48FD-B915-8889E562E8D2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hi all,

Two low-impact security issues have been identified in =
Products.PluggableAuthService:

- an information disclosure issue involving the ZODB Role Manager =
plugin. See =
https://github.com/zopefoundation/Products.PluggableAuthService/security/a=
dvisories/GHSA-p75f-g7gx-2r7p for details.

- an open redirect issue in the Cookie Auth Helper. See =
https://github.com/zopefoundation/Products.PluggableAuthService/security/a=
dvisories/GHSA-p44j-xrqg-4xrr for details.

Both issues are mitigated by updating to Products.PluggableAuthService =
version 2.6.1 or higher. The Plone release managers will apply this =
update with Plone bugfix releases they are planning to publish within =
the next few days.

jens



--Apple-Mail=_BFEEB2F8-5BE8-48FD-B915-8889E562E8D2
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEci4R3bPsmS6uSKPIwbdNWZil9lcFAmA5JCUACgkQwbdNWZil
9ldKChAAvSK+BfI2tVUCh76WgOQR5AIACEqcgLao4KsVryVTLcLeqgGkcJ+xFSHY
+O9mCBE0izWFh7S43hQaa+YIliZiBR+nqP/Zw8bOlIUfHhJJVNK8qxzYkS4KU+w8
UbOVUmE4LWV6IAGy7YOV5WcB8xl4OV+LLwgOtAc8tQlOl+e8a6Bu9cQ1DlAS6xdm
Q5qPnPWUrl02fkfrUV6sgcUU4G4x8wbM/q5QEdLN68veJJiMaF9QVZrQArzcqrd7
kVYbjnI845URp9kl0BZIfAencFhwRt0RSMk4PuFAHQgD1i8RUrtNEIYUsm+V19UG
A/YZGEM0Cxfhzn8+e6rE8rkhYD9+hFsjyTaS7THSJYzcZ9ymFo1Gfcv67JRsx+Ez
h4VJWNOUjs9OTIeG8z2Q+T8x5X3G009j0CymzJNJQyJpAkvRKVwHznmb11NEHkQy
1G8QzhpvATS1dlnOl40KQAREfybMDCw49ECX+o1kza+cBDGP0ulwE9Y4yF79+mxx
0VQ4z0E/cd83UdKBvQBhiz0Iuc12zV+TVo6EoxsDpydA4xBQmaOSq56piIpPVzT3
9R2d6nElL/mG38l9bJNQiiFyBD+CIgYATS/CQOo6xTAmxZ6+/XA5IzLTu1/DRDGx
6zXkK97O7ElUDQXzWKnTWgZpDLqZURQuK1aAy5AUE1pHhDxuAUQ=
=p+2+
-----END PGP SIGNATURE-----

--Apple-Mail=_BFEEB2F8-5BE8-48FD-B915-8889E562E8D2--

--===============4036305243998093974==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zope-Announce maillist  -  [email protected]
https://mail.zope.org/mailman/listinfo/zope-announce

  Zope-Announce for Announcements only - no discussions

(Related lists -
 Users: https://mail.zope.org/mailman/listinfo/zope
 Developers: https://mail.zope.org/mailman/listinfo/zope-dev )

--===============4036305243998093974==--