CVE-2021-32811: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.2
Published: 2021-08-02T22:15Z
Repository: https://github.com/zopefoundation/Zope
Language: Other
Files changed: CHANGES.rst, constraints.txt, requirements-full.txt, setup.py, versions-prod.cfg
Commit date: 2021-07-31 10:26:08 +0200
Commit message: Merge pull request from GHSA-g4gq-j4p2-j8fr

* - require AccessControl 5.2

* - fix wording [ci skip]
Diff: diff --git a/CHANGES.rst b/CHANGES.rst
index 195bcb4334..c129dad1a4 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -9,10 +9,14 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
 
 5.3 (unreleased)
 ----------------
 
+- Update the ``AccessControl`` version pin to fix a remote code execution issue
+  (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf
+  <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_)
+
 - Prevent ``DeprecationWarnings`` from moved imports in ``AccessControl``
 
 - make sure "Manager" users can always modify proxy roles
   (`see Products.PythonScripts#50
     <https://github.com/zopefoundation/Products.PythonScripts/issues/50>`_)
diff --git a/constraints.txt b/constraints.txt
index 7a67fdb2f2..f629ddacde 100644
--- a/constraints.txt
+++ b/constraints.txt
@@ -1,6 +1,6 @@
-AccessControl==5.0
+AccessControl==5.2
 Acquisition==4.7
 AuthEncoding==4.2.1
 BTrees==4.9.1
 Chameleon==3.9.1
 DateTime==4.3
diff --git a/requirements-full.txt b/requirements-full.txt
index 15fd7c2d23..e474b1a290 100644
--- a/requirements-full.txt
+++ b/requirements-full.txt
@@ -1,7 +1,7 @@
 -e git+https://github.com/zopefoundation/Zope.git@master#egg=Zope
-AccessControl==5.0
+AccessControl==5.2
 Acquisition==4.7
 AuthEncoding==4.2.1
 BTrees==4.9.1
 Chameleon==3.9.1
 DateTime==4.3
diff --git a/setup.py b/setup.py
index dd3a9426c6..cb89538c31 100644
--- a/setup.py
+++ b/setup.py
@@ -67,11 +67,11 @@ setup(
     packages=find_packages('src'),
     namespace_packages=['Products', 'Shared', 'Shared.DC', 'zmi'],
     package_dir={'': 'src'},
     python_requires='>= 3.6',
     install_requires=[
-        'AccessControl >= 4.2',
+        'AccessControl >= 5.2',
         'Acquisition',
         'BTrees',
         'Chameleon >= 3.7.0',
         'DateTime',
         'DocumentTemplate >= 4.0',
diff --git a/versions-prod.cfg b/versions-prod.cfg
index 7051498ed6..72b3dcb27f 100644
--- a/versions-prod.cfg
+++ b/versions-prod.cfg
@@ -2,11 +2,11 @@
 # Version pins for required and commonly used dependencies.
 
 [versions]
 Zope =
 Zope2 = 4.0
-AccessControl = 5.0
+AccessControl = 5.2
 Acquisition = 4.7
 AuthEncoding = 4.2.1
 BTrees = 4.9.1
 Chameleon = 3.9.1
 DateTime = 4.3

Vulnerable code: AccessControl==5.0
AccessControl==5.0
        'AccessControl >= 4.2',
AccessControl = 5.0
Fixed code: - Update the ``AccessControl`` version pin to fix a remote code execution issue
  (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf
  <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_)

AccessControl==5.2
AccessControl==5.2
        'AccessControl >= 5.2',
AccessControl = 5.2