README.txt

File details

Size

1 K

File type

text/plain

Click here to get the file

File contents

Hotfix_2002-04-15

  This is a "hotfix" product. Hotfix products can be installed to
  incorporate modifications to Zope at runtime without requiring an
  immediate installation upgrade. Hotfix products are installed just
  as you would install any other Zope product.

  This hotfix addresses an important security issue that may effect
  some users of all Zope versions prior to 2.4.4b2 and 2.5.1b2.

  The issue involves a vulnerability involving "through the web code"
  inadvertently allowing an untrusted user to remotely shut down a
  Zope server by allowing the user to inject special headers into the
  response.  If you allow untrusted users to write "through the web"
  code like Python Scripts, DTML Methods, or Page Templates, your Zope
  server is vulnerable.

  We highly recommend that any Zope site have this hotfix product 
  installed to mitigate the issue. Zope 2.5.1b2 and 2.4.4b2 as
  well as subsequent Zope release versions will contain a fix for the
  issue, at which time the hotfix can be removed.