Zope 4.8.9 and 5.8.4 released with a security fix

--===============2520041201052248837==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_6084BD01-B932-4FF6-ABC2-BC0A4105FB43";
	protocol="application/pgp-signature";
	micalg=pgp-sha512


--Apple-Mail=_6084BD01-B932-4FF6-ABC2-BC0A4105FB43
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On behalf of the Zope developer community I am pleased to announce the =
releases of Zope 4.8.9 and 5.8.4.

These bugfix releases solve a few minor issues and contain a security =
fix. For the full list of changes see the change logs at =
https://zope.readthedocs.io/en/4.x/changes.html#id1 and =
https://zope.readthedocs.io/en/latest/changes.html#id1

Installation instructions can be found at =
https://zope.readthedocs.io/en/4.x/INSTALL.html and =
https://zope.readthedocs.io/en/latest/INSTALL.html.

These releases contain a security fix for the RestrictedPython and =
AccessControl packages, which would allow an attacker with enough =
privileges to add or edit Zope objects containing code (DTML Methods and =
Documents, Script (Python) or Page Templates) to access Python objects =
outside of the Zope sandbox. Due to the high level of access privilege =
required - normally only administrator-level users are allowed to add or =
edit the affected Zope objects - the risk to Zope and Plone site =
maintainers is limited.


The related security advisories with full details are published here:

- =
https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8=
xv7-89vj-q48c
- =
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHS=
A-xjw2-6jm9-rf67

Jens Vagelpohl

--Apple-Mail=_6084BD01-B932-4FF6-ABC2-BC0A4105FB43
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEci4R3bPsmS6uSKPIwbdNWZil9lcFAmT4X2kACgkQwbdNWZil
9lfP7RAAlXcR3HCdeky64XcNtyBX+Za2GTsBgXVXsHdZ2zlIb2OXN0xFCfNEdPMQ
tStZxLKMUXIRisSzHXe2yl8CcYnN17AP7kaYMmORQtMTli9xgtDyYnKGYDT1nTEG
OhI2MSRZQH59m2uSVCn6cPplz/vHggJHl0kbrnneWMZ2dtcqSy5u/q63+hX3Dr5g
nZX8pNwcBNr8CL0nwMiPEJs2Tb1X7CZUDmgUxSY2mhasXe0EipwOhmNfHlRft3x/
NIG/VYUXWScTig7SToyB502w9ySo/XfWn4y4GoaQ7b8jaT4tg4xpgLDKybNK0nQ/
szeS4zhrcuGs/SifuNlRmFXr8JMiDjh9h70YNCAAQmqYU2mtP9nsOJl5VuiZtO2U
A4Z7kstmSOc3WDHxKIgHOFdNil7EMzjz6w/1UPcEUjo8xBJd95XJI41quJE2BIRa
ZZ+oX+5X1NgBCEAoimpN7wPC16GuJL2gmm2Bl3InnBRgwZLcGiBs4HG7ZUGdkTSK
9ZW8evVreXxWkhamAHaqgspmusCYIehKGZhlSBjEc3b6we/RP85V9xf4Ui4D/DYo
iUvSS2ja+DA9rTJwN514vKmNeCreL0porb93YGHEomNloTGoLiJ1X7HPUAsuxSZk
y1whdH5TDaaxvPFQdqvSNZEa3BN013Zy6LeSKdy+eCQKERg93yo=
=Ndhe
-----END PGP SIGNATURE-----

--Apple-Mail=_6084BD01-B932-4FF6-ABC2-BC0A4105FB43--

--===============2520041201052248837==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


_______________________________________________
Zope-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]

List info: https://mail.zope.dev/mailman3/lists/zope-announce.zope.dev
Archive: https://mail.zope.dev/archives/list/zope-announce.zope.dev
Old archive: https://mail.zope.dev/pipermail/zope-announce

--===============2520041201052248837==--