[Fwd: [Security Announce] MDKSA-2000:043 - Zope update]

________________________________________________________________________

                Linux-Mandrake Security Update Advisory
________________________________________________________________________

Package name:		Zope
Date:			September 1st, 2000
Advisory ID:		MDKSA-2000:043

Affected versions:	7.1
________________________________________________________________________

Problem Description:

 The exploit that was not fixed with the previous Zope hotfix involves
 the getRoles method of user objects contained in the default UserFolder
 implementation returning a mutable Python type.  Because the mutable
 object is still associated with the persistent User object, users with
 the ability to edit DTML could arrange to give themselves extra roles