Plone Hotfix package, 2011-05-31
Important note: This is version 2.0 of the hotfix and fixes a critical issue with version 1.0 of the hotfix. You should update your sites to version 2.0 even if you have already applied version 1.0 of the hotfix. The Plone security team apologizes for this error.
This hotfix fixes the following four vulnerabilities:
Reflected XSS attack: A crafted URL can display arbitrary HTML output. This is a vulnerability in CMFPlone affecting all versions of Plone. Thanks to S. Streichsbier of SEC Consult for the responsible disclosure. See CVE-2011-1948 for details.
Persistent XSS attack: Certain valid HTML will allow Javascript filtering to be bypassed. This is a vulnerability in Products.PortalTransforms affecting all versions of Plone using it, including 2.1 through 4.1. Thanks to Daniel Berlin and Dan Bentley both of Google and Brian Peters an independent researcher, for responsibly disclosing this independently of each other. See CVE-2011-1949 for details.
Unauthorized data changes: One form allows users to edit the properties of other users. This is a vulnerability in plone.app.users affecting Plone 4.0 and 4.1. This vulnerability was not disclosed responsibly to the security team. See CVE-2011-1950 for details.
Denial of service: A user can prevent other users from logging in. This is a vulnerability in Products.PluggableAuthService affecting all versions of Plone using it, including 2.5 through 4.1. Thanks to Alan Hoey of Team Rubber for the responsible disclosure. See PAS ticket #789858 for details.
This hotfix is supported on Plone 3 and 4. It is also known to work on Plone 2.5, and may work on older versions of Plone.
The fixes included here will be incorporated into subsequent releases of Plone, so Plone 4.0.7, 4.1rc3, and greater should not require this hotfix.
Installation
Installation instructions can be found at http://plone.org/products/plone-hotfix/releases/20110531
Changelog
2.0 (2011-06-02)
Fix a critical issue preventing correct functioning of one of the patches. [davisagli]
Avoid trying to patch safe_html.StrippingParser if it is not present (as in very old versions of PortalTransforms). [davisagli]
1.0 (2011-06-01)
Initial release [Plone security team]
4 maintainers
Metadata
4 maintainers
Release files for Products.PloneHotfix20110531 2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| Products.PloneHotfix20110531-2.0.zip | 11.2 kB | Without provenance | Details for Products.PloneHotfix20110531-2.0.zip |
Release files / Products.PloneHotfix20110531-2.0.zip
| Download URL | Products.PloneHotfix20110531-2.0.zip |
|---|---|
| Size | 11.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0ec322c9e847706128992207469022432596b973cefa18d014a734efdb46a279
|
|
BLAKE2b-256 checksum How to use checksums |
c1313c3c3852c968ad6b6adae0543998b02db4009fe0e1f945e4bc05a4eb81c1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for Products.PloneHotfix20110531 2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
