[security-alerts] FW: [SA20988] Zope reStructuredText "raw" Directive Information Disclosure

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Zope reStructuredText "raw" Directive Information Disclosure
> 
> SECUNIA ADVISORY ID:
> SA20988
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20988/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Exposure of sensitive information
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Zope 2.x
> http://secunia.com/product/397/
> 
> DESCRIPTION:
> A vulnerability has been reported in Zope, which can be exploited by
> malicious people to disclose potentially sensitive information.
> 
> The vulnerability is caused due to an error in the use of the
> docutils module to parse and render "restructured" text. This can be
> exploited to disclose certain information via the "raw"
> reStructuredText directive.
> 
> The vulnerability has been reported in versions 2.7.0 through 2.7.8,
> 2.8.0 through 2.8.7, and 2.9.0 through 2.9.3.
> 
> SOLUTION:
> Apply patch.
> http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/
> 
> PROVIDED AND/OR DISCOVERED BY:
> Reported by the vendor.
> 
> ORIGINAL ADVISORY:
> http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-200
> 60705/README.txt
>