File contents
Hotfix_2001-03-08
This is a "hotfix" product. Hotfix products can be installed to
incorporate modifications to Zope at runtime without requiring
an immediate installation upgrade. Hotfix products are installed
just as you would install any other Zope product.
This hotfix addresses an important security issue that affects Zope
version 2.3.0 and the current 2.3.1 beta 1 release.
The issue involves an error in the 'aq_inContextOf' method of objects
that support acquisition. A recent change to the access validation
machinery made this bug begin to affect security restrictions. The bug,
with the change to validation, made it possible to access Zope objects
via acquisition that a user would not otherwise have access to. This
issue could allow users with enough internal knowledge of Zope to
perform actions higher in the object hierarchy than they should be able
to.
We *highly* recommend that any Zope site running Zope 2.3.0 final or any
alpha or beta version of 2.3.0 or 2.3.1 beta 1 have this hotfix product
installed to mitigate the issue. Zope 2.3.1 beta 2 will contain a fix for
the issue, at which time the hotfix can be removed. Zope versions prior
to 2.3.0 are not affected by this issue.
Log in
Forgot your password?
