Description
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zope | >= 2.2.0, < 2.4.4 | 2.4.4 | GHSA-c3rp-4cjh-cp38 |
| PyPI | zope | >= 2.5.0, < 2.5.1 | 2.5.1 | GHSA-c3rp-4cjh-cp38 |
| PyPI | zope | >= 2.2.0, < 2.4.4 · >= 2.5.0, < 2.5.1 | 2.4.4, 2.5.1 | PYSEC-2026-758 |
References
- 20020301 [matt@zope.com: [Zope-Annce] Zope Hotfix 2002-03-01 (Ownership Roles Enforcement)] mailing-list
- http://www.zope.org/Products/Zope/hotfixes/
- 4229 vdb-entry
- RHSA-2002:060 vendor-advisory
- zope-proxy-role-privileges(8334) vdb-entry
- 5350 vdb-entry