id: PYSEC-2021-335
details: The module `AccessControl` defines security policies for Python code used
  in restricted code within Zope applications. Restricted code is any code that resides
  in Zope's object database, such as the contents of `Script (Python)` objects. The
  policies defined in `AccessControl` severely restrict access to Python modules and
  only exempt a few that are deemed safe, such as Python's `string` module. However,
  full access to the `string` module also allows access to the class `Formatter`,
  which can be overridden and extended within `Script (Python)` in a way that provides
  access to other unsafe Python libraries. Those unsafe Python libraries can be used
  for remote code execution. By default, you need to have the admin-level Zope "Manager"
  role to add or edit `Script (Python)` objects through the web. Only sites that allow
  untrusted users to add/edit these scripts through the web - which would be a very
  unusual configuration to begin with - are at risk. The problem has been fixed in
  AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable, and
  only on Python 3, not Python 2.7. As a workaround, a site administrator can restrict
  adding/editing `Script (Python)` objects through the web using the standard Zope
  user/role permission mechanisms. Untrusted users should not be assigned the Zope
  Manager role and adding/editing these scripts through the web should be restricted
  to trusted users only. This is the default configuration in Zope.
affected:
- package:
    name: accesscontrol
    ecosystem: PyPI
    purl: pkg:pypi/accesscontrol
  ranges:
  - type: GIT
    repo: https://github.com/zopefoundation/AccessControl
    events:
    - introduced: "0"
    - fixed: b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
  - type: ECOSYSTEM
    events:
    - introduced: "4.0"
    - fixed: "4.3"
    - introduced: "5.0"
    - fixed: "5.2"
  versions:
  - "4.0"
  - "4.1"
  - "4.2"
  - "5.0"
  - "5.1"
references:
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst#51-2021-07-30
- type: FIX
  url: https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
- type: ADVISORY
  url: https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf
aliases:
- CVE-2021-32807
- GHSA-qcx9-j53g-ccgf
modified: "2021-09-26T23:32:08.989778Z"
published: "2021-07-30T22:15:00Z"