zope3 3.2.1-1ubuntu1.2 source package in Ubuntu

Changelog

zope3 (3.2.1-1ubuntu1.2) dapper-security; urgency=low

  * SECURITY UPDATE: arbitrary code execution via ZEO network protocol
    - debian/patches/security-CVE-2009-066x.dpatch: introduce
      ServerMarshaller() and server_find_global() in
      Dependencies/ZEO-Zope-3.2.1/ZEO/zrpc/{marshal.py,connection.py}.
    - CVE-2009-0668
  * SECURITY UPDATE: authentication bypass via ZEO network protocol
    - debian/patches/security-CVE-2009-066x.dpatch: make finish_auth()
      private in Dependencies/ZEO-Zope-3.2.1/ZEO/{auth/auth_digest.py,
      StorageServer.py, tests/auth_plaintext.py}.
    - CVE-2009-0669
  * SECURITY UPDATE: denial of service via too many new object identifiers
    - debian/patches/security-CVE-2009-066x.dpatch: limit new oids to 100
      in Dependencies/ZEO-Zope-3.2.1/ZEO/StorageServer.py.
    - No CVE

 -- Marc Deslauriers <email address hidden>   Tue, 13 Oct 2009 13:55:17 -0400