File contents
Hotfix_2001-08-04
This is a "hotfix" product. Hotfix products can be installed to
incorporate modifications to Zope at runtime without requiring
an immediate installation upgrade. Hotfix products are installed
just as you would install any other Zope product.
This hotfix addresses an important security issue that affects Zope
version 2.3.3, all Zope 2.4.0 alpha and beta releases, as well
as the final release of Zope 2.4.0.
The issue involves an error in the '_check_context' method of the
AccessControl.User.BasicUser class. The bug made it possible to
access Zope objects via acquisition that a user would not otherwise
have access to. This issue could allow users with enough internal
knowledge of Zope to perform actions higher in the object hierarchy
than they should be able to.
We *highly* recommend that any Zope site running Zope 2.3.3, Zope
2.4.0 final or any alpha or beta version of 2.4.0 have this hotfix
product installed to mitigate the issue. Zope 2.4.1 will contain a fix
for the issue, at which time the hotfix can be removed. Zope versions
prior to 2.3.3 are not affected by this issue.
Log in
Forgot your password?
