CVE-2021-32811 (published 2021-08-02T22:15Z)

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one\'s Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/zopefoundation/Zope
commit_details: repo_url: https://github.com/zopefoundation/Zope
author: Jens Vagelpohl
author_date: 2021-07-31 10:26:08+02:00
msg: Merge pull request from GHSA-g4gq-j4p2-j8fr

* - require AccessControl 5.2

* - fix wording [ci skip]
repository: repo_url: https://github.com/zopefoundation/Zope
repo_name: zopefoundation/Zope
description: Zope is an open-source web application server.
repo_language: Python
owner: zopefoundation
file_changes: filename: CHANGES.rst
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,10 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 5.3 (unreleased)
 ----------------
 
+- Update the ``AccessControl`` version pin to fix a remote code execution issue
+  (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf
+  <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_)
+
 - Prevent ``DeprecationWarnings`` from moved imports in ``AccessControl``
 
 - make sure "Manager" users can always modify proxy roles

programming_language: Markdown
filename: constraints.txt
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-AccessControl==5.0
+AccessControl==5.2
 Acquisition==4.7
 AuthEncoding==4.2.1
 BTrees==4.9.1

programming_language: Batchfile
filename: requirements-full.txt
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 -e git+https://github.com/zopefoundation/Zope.git@master#egg=Zope
-AccessControl==5.0
+AccessControl==5.2
 Acquisition==4.7
 AuthEncoding==4.2.1
 BTrees==4.9.1

programming_language: Batchfile
filename: setup.py
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,7 @@ setup(
     package_dir={'': 'src'},
     python_requires='>= 3.6',
     install_requires=[
-        'AccessControl >= 4.2',
+        'AccessControl >= 5.2',
         'Acquisition',
         'BTrees',
         'Chameleon >= 3.7.0',

programming_language: Python
filename: versions-prod.cfg
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
 [versions]
 Zope =
 Zope2 = 4.0
-AccessControl = 5.0
+AccessControl = 5.2
 Acquisition = 4.7
 AuthEncoding = 4.2.1
 BTrees = 4.9.1

programming_language: CoffeeScript