Re: [Zope] Zope and security vulnerability: 20121106

2012-11-14 Thread Christopher N. Deckard
We are running Zope 2.13.10. (So this may not be too helpful.) We are testing the hotfix. This is the output in our event log. 2012-11-14T10:16:49 INFO Products.PloneHotfix20121106 Applied setHeader patch 2012-11-14T10:16:49 INFO Products.PloneHotfix20121106 Applied allow_module patch

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-13 Thread johannes raggam
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 from the security announcement page: https://plone.org/products/plone/security/advisories/20121106-announcement This patch is compatible with all supported Plone versions (i.e. Plone 3 and Plone 4), it may work on earlier versions of Plone, but as

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-13 Thread Jürgen Herrmann
Am 13.11.2012 10:05, schrieb johannes raggam: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 from the security announcement page: https://plone.org/products/plone/security/advisories/20121106-announcement This patch is compatible with all supported Plone versions (i.e. Plone 3 and Plone 4), it

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-13 Thread Jens Vagelpohl
On Nov 13, 2012, at 10:16 , Jürgen Herrmann juergen.herrm...@xlhost.de wrote: I successfully applied these hotfixes to Zope 2.13 versions without any problems. What puzzles me though is why was there no announcement for theses fixes here on zope ml? Or are these fixes not critical for pure

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-13 Thread johannes raggam
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 it was overseen. quoting David Glick on [Zope-CMF] from 9-11-2012: We should have informed you earlier. There are a lot of tasks associated with preparing a hotfix (and this one in particular covered many vulnerabilities), and it got missed. I

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-12 Thread johannes raggam
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The affected versions go back a long time. I don't know it exactly, but people have used it successfully with Plone 2.1 (from ancient times) and I have patched Zope 2.8 instances too. On 11/11/2012 09:43 PM, Allen Schmidt wrote: For which zope

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-12 Thread Richard Harley
So, to clarify, does this affect plain Zope 2.10, no Plone? Rich On 12/11/12 12:02, johannes raggam wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The affected versions go back a long time. I don't know it exactly, but people have used it successfully with Plone 2.1 (from ancient times)

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-12 Thread Marcus Schopen
Am Montag, den 12.11.2012, 12:07 + schrieb Richard Harley: So, to clarify, does this affect plain Zope 2.10, no Plone? That's still the question to me ;) Ciao! ___ Zope maillist - Zope@zope.org https://mail.zope.org/mailman/listinfo/zope **

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-12 Thread Sean Upton
On Mon, Nov 12, 2012 at 5:31 AM, Marcus Schopen li...@localguru.de wrote: Am Montag, den 12.11.2012, 12:07 + schrieb Richard Harley: So, to clarify, does this affect plain Zope 2.10, no Plone? That's still the question to me ;) Why not try product installation and running your instance

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-12 Thread Marcus Schopen
Am Montag, den 12.11.2012, 11:13 -0700 schrieb Sean Upton: On Mon, Nov 12, 2012 at 5:31 AM, Marcus Schopen li...@localguru.de wrote: Am Montag, den 12.11.2012, 12:07 + schrieb Richard Harley: So, to clarify, does this affect plain Zope 2.10, no Plone?

Re: [Zope] Zope and security vulnerability: 20121106

2012-11-11 Thread johannes raggam
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 You can just apply the Plone hotfix for Zope only installations. The Plone patches are not applied then. Johannes On 11/11/2012 06:32 PM, Marcus Schopen wrote: Hi, is a standard Zope affected by this security vulnerability or only if Plone is