Security Advisory/Hotfix 2011-06-22

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============0290785739==
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="------------enig17D5A9532F32DE8D846D1355"

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig17D5A9532F32DE8D846D1355
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Bonjour =E0 tous, (english version below)

Depuis quelques quelques jours, une annonce avait =E9t=E9 faite sur les
listes Zope =E0 propos d'une vuln=E9rabilit=E9 critique concernant un gra=
nd
nombre de versions, sans plus de d=E9tails tant qu'un correctif n'=E9tait=

pas dispo.
L'annonce finale a =E9t=E9 faite :
http://plone.org/products/plone/security/advisories/20110622
Je n'ai pas regard=E9 en grand d=E9tail, mais Zope 2.9 n'est pas concern=E9=
,
et donc CPS non plus.
CPS sur Zope 2.10.12 pourrait =E9ventuellement l'=EAtre (j'en doute) mais=

cela ne concerne =E0 ma connaissance aucune instance de production.

Cordialement,

=3D=3D=3D

A few days ago, there was an advisory about a critical vulnerability for
many Zope versions. No more details were to be disclosed until a hotfix
could be released.
Now the final annoucement has been made :
http://plone.org/products/plone/security/advisories/20110622
I didn't check in great detail yet, but Zope 2.9 is outside the scope of
the vulnerablity, hence CPS users shouldn't worry. There is a chance
that CPS on Zope 2.10.12 could be affected (I doubt it, but will have to
find a few more minutes to check the details), but there are to my
knowledge no production instances of CPS on Zope 2.10.

Cheers

--=20
Georges Racinet, http://www.racinet.fr
Zope/CPS expertise, assistance & development
GPG: 0x4862FFF7 identi.ca & twitter: gracinet



--------------enig17D5A9532F32DE8D846D1355
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJOCxDPAAoJEOAffZJiF+Z4pc4IALVMdpFEVBJOkZTeAgioUQ4X
cyogikhkpKUuwMvzVgCeWcKWC6fpz9jjhYqMNtIrGAXkfcvLM/c0RmXcH+3BM9F9
cA1quZf/+Xj/9hqkXRREi3KXSGf4isEDmH9eHm4xFJujA3kS2yOxxZSsvPpJ7kjr
7fSrd11Zx8gUeusMRLZAgmfq0tZWYzvY98s45VpYvNXo8Pfs6l2Kwt03nn+ZRKXK
GzmLBOyYUKlG/WG4RujNrBWwNy5MWr5gbe5G2jOereAAFu2CXm+C7Znc6g+yXy9t
fzIM0dOCXXyFhnJTpK1YibXJ8SgroL5LPfDK18wHUcBZ0JvDLKKYwWLQL9QK3rc=
=8MO4
-----END PGP SIGNATURE-----

--------------enig17D5A9532F32DE8D846D1355--

--===============0290785739==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
cps-users mailing list
[email protected]
http://lists.nuxeo.com/mailman/listinfo/cps-users

--===============0290785739==--