id: PYSEC-2021-875
details: The module `AccessControl` defines security policies for Python code used
  in restricted code within Zope applications. Restricted code is any code that resides
  in Zope's object database, such as the contents of `Script (Python)` objects. The
  policies defined in `AccessControl` severely restrict access to Python modules and
  only exempt a few that are deemed safe, such as Python's `string` module. However,
  full access to the `string` module also allows access to the class `Formatter`,
  which can be overridden and extended within `Script (Python)` in a way that provides
  access to other unsafe Python libraries. Those unsafe Python libraries can be used
  for remote code execution. By default, you need to have the admin-level Zope "Manager"
  role to add or edit `Script (Python)` objects through the web. Only sites that allow
  untrusted users to add/edit these scripts through the web - which would be a very
  unusual configuration to begin with - are at risk. The problem has been fixed in
  AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable, and
  only on Python 3, not Python 2.7. As a workaround, a site administrator can restrict
  adding/editing `Script (Python)` objects through the web using the standard Zope
  user/role permission mechanisms. Untrusted users should not be assigned the Zope
  Manager role and adding/editing these scripts through the web should be restricted
  to trusted users only. This is the default configuration in Zope.
aliases:
- CVE-2021-32807
- GHSA-qcx9-j53g-ccgf
modified: '2023-05-04T04:29:31.501472Z'
published: '2021-07-30T22:15:00Z'
references:
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst#51-2021-07-30
- type: FIX
  url: https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
- type: ADVISORY
  url: https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf
affected:
- package:
    name: zope
    ecosystem: PyPI
    purl: pkg:pypi/zope
  ranges:
  - type: GIT
    repo: https://github.com/zopefoundation/AccessControl
    events:
    - introduced: '0'
    - fixed: b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
  - type: ECOSYSTEM
    events:
    - introduced: '4.0'
    - fixed: '4.3'
    - introduced: '5.0'
    - fixed: '5.2'
  versions:
  - '4.0'
  - '4.1'
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - '4.2'
  - 4.2.1
  - '5.0'
  - '5.1'
  - 5.1.1
  - 5.1.2