<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you very much for the fix and the new release.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As a user of plain Zope, and having already applied PloneHotfix20210518, I wonder whether I need or should deinstall the hotfix now.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
e.g. the hotfix also touched xmlrpc, which this new release does not.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Or let me rephrase my question.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
What is the current recommended way to mitigate the announced vulnerabilities for a plain Zope setup?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Install the just released Zope version and the hotfix? Or just the latest Zope version?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you!</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Zope <zope-bounces@zope.org> im Auftrag von Jens Vagelpohl <jens@netz.ooo><br>
<b>Gesendet:</b> Freitag, 21. Mai 2021 11:12<br>
<b>An:</b> zope-announce@zope.org <zope-announce@zope.org>; zope@zope.org Users <zope@zope.org><br>
<b>Betreff:</b> [Zope] Zope 4.6 and 5.2 released with an important security fix</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On behalf of Zope developer community I am pleased to announce the releases of Zope 4.6 and 5.2.<br>
<br>
This bugfix release solves a few minor issues and also contains an important security fix, see below. For the full list of changes see the change logs at
<a href="https://zope.readthedocs.io/en/4.x/changes.html#id1">https://zope.readthedocs.io/en/4.x/changes.html#id1</a> and
<a href="https://zope.readthedocs.io/en/latest/changes.html#id1">https://zope.readthedocs.io/en/latest/changes.html#id1</a><br>
<br>
Installation instructions can be found at <a href="https://zope.readthedocs.io/en/4.x/INSTALL.html">
https://zope.readthedocs.io/en/4.x/INSTALL.html</a> and <a href="https://zope.readthedocs.io/en/latest/INSTALL.html">
https://zope.readthedocs.io/en/latest/INSTALL.html</a>.<br>
<br>
NOTE: These releases contain a security fix that prevents remote code execution through TAL expressions. You will only be at risk if you allow untrusted people to add or edit Zope Page Template objects. For more details, see the security advisory at
<a href="https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36">
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36</a>. A CVE has been requested through GitHub.<br>
<br>
NOTE FOR PLONE USERS: Before installing Zope 4.6 or 5.2 make sure to install PloneHotfix20210518 first, see
<a href="https://plone.org/security/hotfix/20210518">https://plone.org/security/hotfix/20210518</a>. The security changes in Zope break some Plone add-ons that relied on the old insecure traversal behavior. PloneHotfix20210518 ensures support for those Plone
add-ons.<br>
<br>
Jens Vagelpohl<br>
</div>
</span></font></div>
</body>
</html>