id: PYSEC-2021-45
details: Products.PluggableAuthService is a pluggable Zope authentication and authorization
  framework. In Products.PluggableAuthService before version 2.6.0 there is an open
  redirect vulnerability. A maliciously crafted link to the login form and login functionality
  could redirect the browser to a different website. The problem has been fixed in
  version 2.6.1. Depending on how you have installed Products.PluggableAuthService,
  you should change the buildout version pin to `2.6.1` and re-run the buildout, or
  if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".
affected:
- package:
    name: products-pluggableauthservice
    ecosystem: PyPI
    purl: pkg:pypi/products-pluggableauthservice
  ranges:
  - type: GIT
    repo: https://github.com/zopefoundation/Products.PluggableAuthService
    events:
    - introduced: "0"
    - fixed: 7eead067898852ebd3e0f143bc51295928528dfa
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.6.1
  versions:
  - 1.5.2
  - 1.5.2.1
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - "1.6"
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.7.0b1
  - 1.7.0b2
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 1.8.0
  - 1.9.0
  - 1.10.0
  - 1.11.0
  - 1.11.1
  - 1.11.2
  - 1.11.3
  - 2.0b1
  - 2.0b2
  - 2.0b3
  - 2.0b4
  - 2.0b5
  - 2.0b6
  - "2.0"
  - "2.1"
  - 2.1.1
  - "2.2"
  - 2.2.1
  - "2.3"
  - "2.4"
  - "2.5"
  - 2.5.1
  - 2.6.0
references:
- type: ADVISORY
  url: https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr
- type: PACKAGE
  url: https://pypi.org/project/Products.PluggableAuthService/
- type: FIX
  url: https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfa
aliases:
- CVE-2021-21337
- GHSA-p44j-xrqg-4xrr
modified: "2021-03-12T13:48:00Z"
published: "2021-03-08T21:15:00Z"