Re: CVE-2011-4924 assignment notification -- Zope2, Zope3: Incomplete upstream fix for CVE-2010-1104 issue

[Yves-Alexis Perez <corsac () debian org>]

On jeu., 2012-01-19 at 13:12 +0100, Jan Lieskovsky wrote:
> A cross site scripting (XSS) flaw was found in the way Zope2 and Zope3
> performed error messages sanitization. If a remote attacker could trick a user,
> who was logged into Zope2, into visiting a specially-crafted URL, it would lead
> to arbitrary web script execution in the context of user's Zope2 session. If a
> remote attacker could trick a user, who was logged into Zope3, into examining
> error entries for particular Zope3 instance, it would lead to arbitrary web
> script execution in the context of user's Zope3 session. 

Does this mean CVE-2010-1104 applies to Zope3 too, or the fix for this
CVE created CVE-2011-4924?

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part