CVE-2008-5102

Advisory

Zopeskel before <2.11 uses an insecure transitive dependency (Zope before 2.9.10).

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------------

* Make the Plone 3 buildout default to Plone 3.2.1, and pick up
${versions:zope2-url} for Plone > 3.1
[MatthewWilkes]

* added a version requirement for Cheetah (>1.0)
[tarek]

* fix zopeskel/docs/localcommands.txt
[yboussard]

* Modify zopeskel/templates/plone/+namespace_package+/+package+/tests.py_tmpl
to init egg as product if it is a Zope2 product.
[yboussard]

* Modify plone3_buildout template to ask for a Plone version. If the version
is 3.0 or 3.1 it uses the plone install recipe, otherwise it uses the Plone
egg from the cheeseshop.
[MatthewWilkes]

* Link to appropriate PyPI pages for recipes used.
[MatthewWilkes]

* Add a Zope 2 without Plone buildout template.
[evilbungle]

* Reconciling HISTORY.txt to mirror what can be found at the following:
http://pypi.python.org/pypi/ZopeSkel/2.10. Release of 2.10 was clobbered
due to what looks like a merge at r74790.
[andrewb]

* Update plone2.5_template's buildout.cfg_tmpl to use Zope 2.9.10. This
release incorporates Hotfix-2008-08-12. Defaulting to a known insecure
Zope seems unwise for people that may be updating legacy environments into
buildout, since they're likely to forget to include the hotfix. Url to
2.9.10 hard-coded (as opposed to the more elegantly self-aware
plone.recipe.plone approach) per the practice of a plone.recipe.distros
plone part.
[andrewb]

* Nearly at the end of the creation of a ZopeSkel template, the local
commands available for that template are displayed.
[jaraco, markvl]

* The Plone template now has local commands. (Basically moved them
from the archetype templates to plone templates and made them
available for both.
[markvl]

* Added base test setup to the archetype template. Added wiring code that
runs README.txt as a doctest.
[esartor]

* Added tests to the addcontent contenttype command. These ammend the
README.txt file for each content type providing basic tests for creating,
editing and removing instances of the added content type.
[esartor]

Resources

• https://pypi.org/project/zopeskel
• https://pyup.io/changelogs/zopeskel/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5102