IMPORTANT UPDATE re a flaw in yesterday's Plone security hotfix

On 6/1/11 11:47 AM, David Glick wrote:
> The Plone Security team released a new hotfix this morning, "Plone
> Hotfix 20110531," addressing 4 vulnerabilities.  Please take the time as
> soon as possible to install this hotfix on any sites for which you are
> responsible.
>
> Installation instructions for the hotfix can be found at
> http://plone.org/products/plone-hotfix/releases/20110531

The Plone security team is sorry to announce that a flaw in 
Hotfix20110531 released on the 1st June 2011 has been found.  The 
escalation of privileges attack was not blocked on Plone 4, despite 
having the fix installed.

As such, we have released version 2.0 of this fix which contains a 
tighter check for potential attacks, which is available at 
http://plone.org/products/plone-hotfix/releases/20110531. If you have 
already installed Hotfix20110531 on Plone 4 you need to update to 
version 2.0.  For Plone 3.x and Plone 2.x, if Hotfix20110531 is not yet 
installed you should install version 2.0.  If you have version 1.0 of 
Hotfix20110531 installed on Plone 3.x or 2.x you do not need to upgrade.

We apologize for the inconvenience this has caused; we will be doing a 
postmortem on this fix to further improve our security patch release 
procedures in the coming weeks.

David Glick
on behalf of the Plone security team



----------		
David Glick
 Web Developer
 [email protected]
 206.286.1235x32

Groundwire: You Are Connected		
 http://groundwire.org		

Online tools and strategies for the environmental movement.  Sign up for Groundwire News!
 http://groundwire.org/email-capture



------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger.
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Discover what all the cheering's about.
Get your free trial download today. 
http://p.sf.net/sfu/quest-dev2dev2