[ http://www.rootshell.com/ ]

Date: Tue, 04 Jan 2000 17:12:46 -0500
Subject: [Zope] SECURITY ALERT
From: Christopher Petrilli <petrilli@digicool.com>
To: <zope-announce@zope.org>, <zope@zope.org>, <zope-dev@zope.org>

Ok, now that we've got your attention...

Thanks to Kevin Littlejohn's sleuthing, a sizable problem in the security
machinery in DTML has been brought to our attention and resolved.  Without
delving too deeply into the obtuseness of the problem, let me first say that
this is 1) very critical, 2) has an urgent fix.

This problem is of most concern to anyone who opens their Zope site up to
the general public (a'la zope.org) as it could allow "anonymous" people to
do things which are most definitely not allowed.  Unfortunately it was
introduced many releases ago, but to our knowledge this is the first time
anyone has discovered this problem.

Fixes are contained in the CVS repository as well as:

Zope 2.1.2          http://www.zope.org/Products/Zope/2.1.2/
Patch to 1.10.3     http://www.zope.org/Products/Zope/2.1.2/1104_patch.html

It is important to note that the patch to 1.10.3 has some performance impact
on users of this release.  Unfortunately, we are no longer able to provide
equal levels of support for users of 1.x and 2.x implementations of Zope. If
there are reasons that your site is unable to transition to 2.x, please let
us know so that we can work to resolve them in future releases so that we
can finally retire the old 1.x line of code.

If you have any questions regarding the impact to your site of the changes,
please send them to support@digicool.com

Chris
--
| Christopher Petrilli        Python Powered        Digital Creations, Inc.
| petrilli@digicool.com                             http://www.digicool.com