Bugzilla Bug 198357

FrSIRT/ADV-2007-3754:
  A vulnerability has been identified in Plone, which could be
  exploited by remote attackers to compromise a vulnerable system.
  This issue is caused by input validation errors in the
  "statusmessages" and "linkintegrity" modules that interpret unsafe
  network data as python pickles, which could be exploited by remote
  attackers to execute arbitrary commands with the privileges of the
  Zope/Plone process.

"Affected versions
    * Plone 2.5 up to and including 2.5.4
    * Plone 3.0 up to and including 3.0.2

These fixes are included in the 2.5.5 and 3.0.3 releases, at which point this
hotfix can be removed."

Net-Zope, please advise.

We will release 2.5.5 version bump version this weekend. Last security problem
didnt result in GLSA, so maybe this time it should be done to get some
visibilty.

(In reply to comment #2)
> We will release 2.5.5 version bump version this weekend. Last security problem
> didnt result in GLSA, so maybe this time it should be done to get some
> visibilty.

Security policy is that ~arch packages are not subject to GLSAs. If version
numbers in the upstream announcement are correct, stable ebuilds are not
affected here.

(In reply to comment #2)
> We will release 2.5.5 version bump version this weekend. Last security problem
> didnt result in GLSA, so maybe this time it should be done to get some
> visibilty.
> 

any news here?

Zope herd, please bump.

http://plone.org/products/plone-hotfix/releases/20071106-2
Version 2 of the hotfix corrects several bugs found in the original release.

Zope, what'S the status here?

(In reply to comment #6)
> http://plone.org/products/plone-hotfix/releases/20071106-2
> Version 2 of the hotfix corrects several bugs found in the original release.
> 
> Zope, what'S the status here?
> 

*ping*

It took our one-man-herd ;) a little bit longer. Sorry for that.
I commited corrected ebuild for version 2.5.5 to the tree.

BTW: should I change bug's Whiteboard after such action?

No need to, we're monitoring comments and do the next steps.
Thanks for bumping!

This issue only affects ~arch ebuilds, so it will not result in a GLSA. If you
want the 2.5 branch to be subject to "full" security support, you need to get
this current version stable. Please remove the vulnerable 2.5 and 2.5.3 ebuilds
if you can.