PYSEC-2006-7

Withdrawn 2024-11-22. This finding no longer applies and is kept for reference. It is not used when checking packages.

Details

Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/zope2

Introduced in: 0

No fixed version published yet for zope2 (pip). Pin to a known-safe version or switch to an alternative.

References

http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt[WEB]
http://secunia.com/advisories/20988[ADVISORY]
http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html[WEB]
http://www.securityfocus.com/bid/18856[WEB]
http://secunia.com/advisories/21025[ADVISORY]
http://www.debian.org/security/2006/dsa-1113[ADVISORY]
http://secunia.com/advisories/21130[ADVISORY]
http://www.novell.com/linux/security/advisories/2006_19_sr.html[ADVISORY]
http://secunia.com/advisories/21459[ADVISORY]
http://www.vupen.com/english/advisories/2006/2681[ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/27636[WEB]
https://usn.ubuntu.com/317-1/[WEB]
https://github.com/advisories/GHSA-jcjp-qqpq-pc54[ADVISORY]