CVE-2023-44389

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

------------------

- Make sure the object title in the ZMI breadcrumbs is quoted
to prevent a cross-site scripting issue.

- Update to newest compatible versions of dependencies.

- Base the inline/attachment logic developed for CVE-2023-42458
on the media type proper (ignore parameters and
whitespace and normalize to lowercase)
(`1167 <https://github.com/zopefoundation/Zope/pull/1167>`_).

Resources

• https://pypi.org/project/zope
• https://data.safetycli.com/changelogs/zope/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44389
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a