A security flaw was discovered in python scripts shipped within the Zope application server framework of version 2. Local user with unrestricted access to the ZMI and ability to edit python scripts could use this flaw to cause the whole Zope 2 instance shutdown or to import the 'test' module of Python and execute all tests (DoS). Affected Zope 2 versions: Zope 2.7.0 to Zope 2.11.2 Proposed patch: http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz References: http://bugs.gentoo.org/show_bug.cgi?id=246411 http://www.zope.org/Products/Zope/Hotfix-2008-08-12/README.txt http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz Note: This issue also affects the PythonScripts of the Zope 2 package, as shipped within the Conga project: -- conga-0.9.1-8 contains Zope-2.7.5 RC2 -- conga-0.12.0-7.el5 contains Zope-2.8.4
This issue affects the conga package, as shipped with Red Hat Enterprise Linux 5 Update 2 (conga-0.12.0-7.el5), with Red Hat Enterprise Linux 4 Cluster Suite (conga-0.9.1-8) and within the Extra Packages for Enterprise Linux 5 project (zope-2.10.6-1.el5). This issue does NOT affect the versions of the python-zope-interface package, as shipped within the Fedora releases of 8, 9 and 10 and withing EPEL 4 and 5.
CVE id CVE-2008-5102 was assigned to this issue: PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.
The zope currently in EPEL is not vulnerable as the hotfix was integrated as of Zope 2.10.7, currently 2.10.9 is latest: http://koji.fedoraproject.org/koji/buildinfo?buildID=126121