CVE-2013-4191

Advisory

Plone 4.1, 4.2.5 and 4.3.1 include a fix for CVE-2013-4191: zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.


MLIST:[oss-security] 20130801 Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors): http://seclists.org/oss-sec/2013/q3/261
CONFIRM:http://plone.org/products/plone-hotfix/releases/20130618: http://plone.org/products/plone-hotfix/releases/20130618
CONFIRM:http://plone.org/products/plone/security/advisories/20130618-announcement: http://plone.org/products/plone/security/advisories/20130618-announcement
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=978453: https://bugzilla.redhat.com/show_bug.cgi?id=978453

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4191
• http://plone.org/products/plone-hotfix/releases/20130618
• http://seclists.org/oss-sec/2013/q3/261
• https://bugzilla.redhat.com/show_bug.cgi?id=978453
• http://plone.org/products/plone/security/advisories/20130618-announcement