[Zope-Annce] SECURITY: Hotfix 2002-04-15
Mon, 15 Apr 2002 16:23:59 -0400
This hotfix addresses an important security issue that may affect
some users of Zope versions 2.0 through 2.5.1 b1.
The issue involves a vulnerability involving "through the web code"
inadvertently allowing an untrusted user to remotely shut down a
Zope server by allowing the user to inject special headers into the
response. If you allow untrusted users to write "through the web"
code like Python Scripts, DTML Methods, or Page Templates, your Zope
server is vulnerable.
We highly recommend that any Zope site have this hotfix product
installed to mitigate the issue. Zope 2.5.1b2 and 2.4.4b2 as
well as subsequent Zope release versions will contain a fix for the
issue, at which time the hotfix can be removed.
Brian Lloyd firstname.lastname@example.org
V.P. Engineering 540.361.1716
Zope Corporation http://www.zope.com