[Security issue] SQL injection in DTML or in connection objects

--===============3203230458504672798==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_30CEAF25-F241-49B3-992F-E6A0E6A4FC05";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_30CEAF25-F241-49B3-992F-E6A0E6A4FC05
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On behalf of the Plone security team I am announcing this security issue =
in Zope also here:

CVE Identifier: CVE-2020-7939
Type: SQL injection
Severity: 4.9 =E2=80=93 MEDIUM
Affected Zope versions:
 * Zope 2 older than 2.13.30 (2.13.30 is not yet released)
 * Zope 4 older than 4.2

For details see =
https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-con=
nection-objects

To fix the issue use the Hotfix provided at =
https://plone.org/security/hotfix/20200121 (version 1.1 or newer)
or upgrade to Zope 4.2+.
There is no released Zope 2.13 version, yet, which includes the fix. (I =
hope it will can released soon.)

--
Mit freundlichen Gr=C3=BC=C3=9Fen
Michael Howitz


--Apple-Mail=_30CEAF25-F241-49B3-992F-E6A0E6A4FC05
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEzRcZ5x+BCFYq+baDYQXEIR/92gQFAl5D9SQACgkQYQXEIR/9
2gSsnwf/af/MgGRVXBtgRaBtFOvh+TStEQYqrC65L075+zvRyjRGqAXzcamvIKcd
j+iB+awZiaoBomrZJnc9KsyiU344Q9sb40w9XDscPzcoRKaEsC22zBvBpxVr+JWl
dxNiluCfecrk59MyhI5TG8PkViaYlx1wcwFMDvvi6mLLOy5zdglGLaRfpVk86dOz
sxPsMXWmKn/qLS+jraWhd7+Xp4/gd7RwJ0/Uh1p8DUDlK6wYNrTv8Br/T7Qwdkbp
4QmmbkRDcVE53+cvTZ1W5SKOOOxmO5/0EjtIY8wLyz5vq4VqWvO0Le+6Sgw4Hemt
dyFsF4C79EHfkiwlPR9DK/gi3ct85Q==
=d24d
-----END PGP SIGNATURE-----

--Apple-Mail=_30CEAF25-F241-49B3-992F-E6A0E6A4FC05--

--===============3203230458504672798==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zope-Announce maillist  -  [email protected]
https://mail.zope.org/mailman/listinfo/zope-announce

  Zope-Announce for Announcements only - no discussions

(Related lists -
 Users: https://mail.zope.org/mailman/listinfo/zope
 Developers: https://mail.zope.org/mailman/listinfo/zope-dev )

--===============3203230458504672798==--