Re: [Zope] Zope 4.6 and 5.2 released with an important security fix

--===============2493159819327024452==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_268F35D1-2BC3-4405-A68A-025435BC0164";
	protocol="application/pgp-signature";
	micalg=pgp-sha512


--Apple-Mail=_268F35D1-2BC3-4405-A68A-025435BC0164
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi J=C3=BCrgen,

Zope and Plone are still two different projects. The Plone developers =
published a hotfix product that fixes everything they believe needed to =
be fixed. I looked at items that apply to plain Zope and made the =
required changes in Zope.

So anyone using plain Zope can install the latest update and they are =
safe. As a plain Zope developer I cannot comment on or make =
recommendations regarding a Plone hotfix, and Zope itself will never =
require a Plone add-on or hotfix. I don=E2=80=99t have any control over =
how the Plone release managers communicate these fixes, either. People =
who do not use Plone are advised to stick to published Zope updates.

jens



> On 21. May 2021, at 12:25 , J=C3=BCrgen Gmach <[email protected]> =
wrote:
>=20
> Thank you very much for the fix and the new release.
>=20
> As a user of plain Zope, and having already applied =
PloneHotfix20210518, I wonder whether I need or should deinstall the =
hotfix now.
>=20
> e.g. the hotfix also touched xmlrpc, which this new release does not.
>=20
> Or let me rephrase my question.
>=20
> What is the current recommended way to mitigate the announced =
vulnerabilities for a plain Zope setup?
>=20
> Install the just released Zope version and the hotfix? Or just the =
latest Zope version?
>=20
> Thank you!
> Von: Zope <[email protected]> im Auftrag von Jens Vagelpohl =
<[email protected]>
> Gesendet: Freitag, 21. Mai 2021 11:12
> An: [email protected] <[email protected]>; [email protected] =
Users <[email protected]>
> Betreff: [Zope] Zope 4.6 and 5.2 released with an important security =
fix
>=20
> On behalf of Zope developer community I am pleased to announce the =
releases of Zope 4.6 and 5.2.
>=20
> This bugfix release solves a few minor issues and also contains an =
important security fix, see below. For the full list of changes see the =
change logs athttps://zope.readthedocs.io/en/4.x/changes.html#id1 =
andhttps://zope.readthedocs.io/en/latest/changes.html#id1
>=20
> Installation instructions can be found at =
https://zope.readthedocs.io/en/4.x/INSTALL.html and =
https://zope.readthedocs.io/en/latest/INSTALL.html.
>=20
> NOTE: These releases contain a security fix that prevents remote code =
execution through TAL expressions. You will only be at risk if you allow =
untrusted people to add or edit Zope Page Template objects. For more =
details, see the security advisory =
athttps://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v23=
4-jw36. A CVE has been requested through GitHub.
>=20
> NOTE FOR PLONE USERS: Before installing Zope 4.6 or 5.2 make sure to =
install PloneHotfix20210518 first, see =
https://plone.org/security/hotfix/20210518. The security changes in Zope =
break some Plone add-ons that relied on the old insecure traversal =
behavior. PloneHotfix20210518 ensures support for those Plone add-ons.
>=20
> Jens Vagelpohl
>=20
> _______________________________________________
> Zope maillist  -  [email protected]
> https://mail.zope.org/mailman/listinfo/zope
> **   No cross posts or HTML encoding!  **
> (Related lists -
> https://mail.zope.org/mailman/listinfo/zope-announce
> https://mail.zope.org/mailman/listinfo/zope-dev )


--Apple-Mail=_268F35D1-2BC3-4405-A68A-025435BC0164
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEci4R3bPsmS6uSKPIwbdNWZil9lcFAmCnj9YACgkQwbdNWZil
9ldxpQ/+IMeI2tk2MhscoLbJqgsO3tp3Vidhv/jQfgO2kqIL6P957/Sn6tiCKUVc
hKrQ8EVwqxKwGTsbSgm7xDugTviRl7dcLk74KuKQnytiFK7uU+I3nFC57mZMCgnq
MVqbgE+L2axVeD7tgXpDLB37B8geaKErG54limvGbpY8bErEx/YH+bp2ip3DeRBU
/0ZglSKF1WRC2ysK/IiyJjmXL/gTtAPrU411aba2u3rNJL7MPS6gSzXLa98xTxp4
Tkl2+JRqYjFJ9VvzP9aiOuNwDnsmO4yjX8xUJXxQ6QXFTDVpTDicrp7qs165MpV2
Go2O8SmoitTO+ySd6yKXdFBnmYalwoJ3MEjsEQMQN57x2ZSYE4AWIOYnAeq8u/Ve
hyAHGo2cW7gILgJNhL+QVk6FVCcDanOI6LwqOaDSs2g2UglTPYk1So3liFiX8Ihn
sMouWB+grBb3WDZF46zSywU1JngLOhGKUp8xEtpH8jQBt/wmUz2QO6c/fn1pr11R
6j9tuAjnJ8AAA5M2Xmfutd7N8ijUq2cryLZDOqNZIobgXpxfw0Syut7EJ5wOnj8k
8jDIQndALPgf0AjJYTXiVw7A2SKxtA//qn8l+qYOSM5zE5HZmU38DpvQRmflyqk/
gIuA8HNzB2RiV2R+F9hUpTp4AdfldPMJoQx19IbeztwZ1BwvhLc=
=eBbu
-----END PGP SIGNATURE-----

--Apple-Mail=_268F35D1-2BC3-4405-A68A-025435BC0164--

--===============2493159819327024452==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zope-Announce maillist  -  [email protected]
https://mail.zope.org/mailman/listinfo/zope-announce

  Zope-Announce for Announcements only - no discussions

(Related lists -
 Users: https://mail.zope.org/mailman/listinfo/zope
 Developers: https://mail.zope.org/mailman/listinfo/zope-dev )

--===============2493159819327024452==--