You are not logged in Log in Join
You are here: Home » Download Zope Products » Zope » Hotfix_2001-08-04 » README.txt

Log in




File details
1 K
File type

File contents


  This is a "hotfix" product. Hotfix products can be installed to 
  incorporate modifications to Zope at runtime without requiring 
  an immediate installation upgrade. Hotfix products are installed 
  just as you would install any other Zope product.

  This hotfix addresses an important security issue that affects Zope 
  version 2.3.3, all Zope 2.4.0 alpha and beta releases, as well
  as the final release of Zope 2.4.0.

  The issue involves an error in the '_check_context' method of the
  AccessControl.User.BasicUser class.  The bug made it possible to
  access Zope objects via acquisition that a user would not otherwise
  have access to. This issue could allow users with enough internal
  knowledge of Zope to perform actions higher in the object hierarchy
  than they should be able to. 

  We *highly* recommend that any Zope site running Zope 2.3.3, Zope
  2.4.0 final or any alpha or beta version of 2.4.0 have this hotfix
  product installed to mitigate the issue. Zope 2.4.1 will contain a fix
  for the issue, at which time the hotfix can be removed. Zope versions
  prior to 2.3.3 are not affected by this issue.