CVE-2021-32807

Advisory

Zope 5.3 updates its dependency 'AccessControl' to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

----------------

- Update the ``AccessControl`` version pin to fix a remote code execution issue
(see `AccessControl security advisory GHSA-qcx9-j53g-ccgf
<https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_)

- Prevent ``DeprecationWarnings`` from moved imports in ``AccessControl``

- make sure "Manager" users can always modify proxy roles
(`see Products.PythonScripts50
<https://github.com/zopefoundation/Products.PythonScripts/issues/50>`_)

- Deprecate usage of "unicode" converters. Also, the behavior of
``field2lines`` is now aligned to the other converters and returns a list of
strings instead of a list of bytes.
(`962 <https://github.com/zopefoundation/Zope/issues/962>`_)

- Update to newest compatible versions of dependencies.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32807