CVE-2022-24761

Advisory

Zope 5.5.1 and 4.8.1 update its dependency 'waitress' to v2.1.1 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

- Update to newest compatible versions of dependencies.

- Update ``waitress`` to version 2.1.1 to mitigate a vulnerability in that
package. As that ``waitress`` no longer supports Python 3.6 it is not advised
to run Zope on Python 3.6 any longer even though it still supports Python
3.6.

- To run ``bin/buildout`` inside the Zope project now ``zc.buildout >= 2.13.7``
or ``zc.buildout >= 3.0.0b1`` is required.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24761