Minor Plone Security Fixes
"Announcement of Plone releases and security-related notifications. Recommended subscription for all Plone developers and site admins." <[email protected]> Thu, 7 Jul 2016 15:52:28 -0500
| Newsgroups | gmane.comp.web.zope.plone.announce |
|---|---|
| Message-ID | <[email protected]> |
--===============4192740325117494070==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_360CF2D8-7518-439E-859C-C84A610113B8"
--Apple-Mail=_360CF2D8-7518-439E-859C-C84A610113B8
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
> https://plone.org/news/2016/minor-plone-security-fixes =
<https://plone.org/news/2016/minor-plone-security-fixes>
>=20
> Minor Plone Security Fixes
>=20
> The Plone Security Team has released new versions of several packages. =
These new versions remedy several security-related issues, none of which =
were significant enough to warrant a full security hotfix.
>=20
> Issues and version updates are detailed below. You may use the new =
versions in your Plone installation by adding =E2=80=9Cpinning=E2=80=9D =
version numbers to your buildout =
<http://docs.plone.org/manage/installing/installing_addons.html?highlight=3D=
pin#pinning-add-on-versions>.
>=20
> The new versions include releases of Pillow (provided by the Pillow =
security team) and PloneFormGen (provided by the PloneFormGen =
maintainers).
>=20
> Plone release
>=20
> All fixes mentioned below in the other packages, are included in new =
Plone releases. So if you can update your site in the normal way to one =
of these versions, that is best. Please apply the normal procedures you =
use for updating your site. This should include testing the upgrade on =
a copy of your site.
> Exception: Products.PloneFormgen is an add-on that is not included in =
the core versions of Plone. You need to update this explicitly.
> Plone 4.2 or earlier: no new versions list is made available.
> Plone 4.3: extend http://dist.plone.org/release/4.3.10/versions.cfg =
<http://dist.plone.org/release/4.3.10/versions.cfg> or use the =
installer.
> Plone 5.0: extend http://dist.plone.org/release/5.0.5/versions.cfg =
<http://dist.plone.org/release/5.0.5/versions.cfg> or use the installer.
> plone.app.discussion
>=20
> Nature of vulnerability: Cross Site Scripting (XSS) attack on comment =
moderation page.
> Affected: this only affects you if you have enabled commenting, and =
have enabled comment moderation, and are using plain text or =
intelligenttext as comment format. The only spot where you are =
vulnerable, is on the comment moderation page. So regular visitors of =
your site have nothing to fear. If you have enabled anonymous =
commenting, this attack is open for anyone, which makes this the most =
serious one.
> Workaround: Switch to MarkDown or html as comment format. Because =
existing comments may still be affected: use the moderation options on =
the page where the comment appears. Or use the moderation page with =
javascript turned off.
> Plone 4.0 or earlier: not affected, because plone.app.discussion is =
not included in the core.
> Plone 4.1, 4.2: use plone.app.discussion 2.1.2
> Plone 4.3: use plone.app.discussion 2.2.18
> Plone 5.0: use plone.app.discussion 2.4.16
> Products.CMFPlone (1)
>=20
> Nature of vulnerability: exposing properties of the site to anonymous =
users. We mean properties from the Properties tab in the Zope =
Management Interface, or from the portal_properties tool.
> Affected: this affects everyone. In standard Plone nothing very =
interesting can be seen. But if you have an add-on or own code that =
stores a secret key here, anonymous users can view this.
> Workaround: do not use the properties to store info that needs to =
remain secret. The configuration registry is a much better place for =
this.
> Plone 4.2 or earlier: no fix is issued.
> Plone 4.3 or earlier: use Products.CMFPlone 4.3.10
> Plone 5.0: use Products.CMFPlone 5.0.5
> Products.CMFPlone (2)
>=20
> Nature of vulnerability: Cross Site Scripting (XSS) attack in any =
field that uses the select2 pattern. By default these are the =
contributors, creators, and tag fields.
> Affected: this affects you if untrusted or compromised users can =
create or edit content. You are only vulnerable when editing content.
> Workaround: use the edit pages with javascript turned off (which =
admittedly is not nice).
> Plone 4.3 or earlier: not affected
> Plone 5.0: use Products.CMFPlone 5.0.5
> mockup
>=20
> This is the same vulnerability as in Products.CMFPlone (2). The =
mockup package is only used when you are compiling javascript resources =
in the new resource registries control panel.
> Plone 4.3 or earlier: not affected
> Plone 5.0: use mockup 2.1.5
> plone.app.event
>=20
> Nature of vulnerability: Cross Site Scripting (XSS) attack in location =
field of Events.
> Affected: this affects you if untrusted or compromised users can =
create or edit Events.
> Note: these are the dexterity events. Plone 4 does not ship with =
this, but you may have added it.
> Plone 4.2 or earlier: plone.app.event is not used by default. If you =
do use it, you probably know what you are doing.
> Plone 4.3: use plone.app.event 1.1.6 (if your site uses this package). =
Note: if you had custom code to override the `get_location` view helper =
method to return html, this no longer works. For plain text it still =
works fine, but the `get_location` method is gone in version 2.0, for =
simplicity. Instead you can override the necessary templates in your =
add-ons.
> Plone 5.0: use plone.app.event 2.0.10
> plone.app.contenttypes
>=20
> Nature of vulnerability: Cross Site Scripting (XSS) attack in the =
caption field of the leadimage behavior.
> Affected: this affects you if untrusted or compromised users can =
create or edit content. By default only News Items use the leadimage =
behavior, but this behavior may have been enabled on other types.
> Note: this is a package with dexterity content types. Plone 4 does =
not ship with this, but you may have added it. Archetypes News Items =
are not affected.
> Note: there is also the collective.contentleadimage package, which =
does a similar thing for Archetypes content, but this is not affected.
> Plone 4.2 or earlier: plone.app.contenttypes is not used by default. =
If you do use it, you probably know what you are doing.
> Plone 4.3: use plone.app.contenttypes 1.1.1. Note that only news =
items are affected, because the leadimage caption is not shown in the =
behavior.
> Plone 5.0: use plone.app.contenttypes 1.2.15
> Products.PloneFormGen
>=20
> Nature of vulnerability: The 'help' field of form fields was not HTML =
escaped, allowing it to be used for an XSS attack.
> Affected: this only affects you if you allow untrusted or compromised =
users to create forms.
> For more info, see =
https://github.com/smcmahon/Products.PloneFormGen/blob/master/CHANGES.txt =
<https://github.com/smcmahon/Products.PloneFormGen/blob/master/CHANGES.txt=
>
> On Plone 4.1 and higher, update to Products.PloneFormGen 1.7.19.
> On Plone 5.0 and higher, update to Products.PloneFormGen 1.8.1.
> Pillow
>=20
> Nature of vulnerability: When an attacker uploads a specially crafted =
image, the Plone Site may crash. Theoretically he may get access to =
other parts of the memory of your machine, due to a buffer overflow.
> Affected: this only affects you if you allow untrusted or compromised =
users to upload images.
> For more info, see =
http://pillow.readthedocs.io/en/3.2.x/releasenotes/index.html =
<http://pillow.readthedocs.io/en/3.2.x/releasenotes/index.html>
> You might be using PIL or PILwoTk instead of Pillow, but they have =
basically the same problem.
> On Plone 4.0 and higher, update to Pillow 3.1.2 or 3.2.0.
> On Plone 3 you need to use Python 2.4, and the latest compatible =
Pillow version is 1.7.0, which may be vulnerable. There is no fix here. =
Note that both Plone 3 and Python 2.4 are not getting security updates =
anymore.
> Versions
>=20
> These are the versions that you should update in the `[versions]` =
section of your buildout.cfg configuration file:=20
>=20
> On Plone 4.0:
>=20
> Pillow =3D 3.2.0
> Products.PloneFormGen =3D 1.7.19=20
> On Plone 4.1 and 4.2:
>=20
> Pillow =3D 3.2.0
> plone.app.discussion =3D 2.1.2
> Products.PloneFormGen =3D 1.7.19
> On Plone 4.3:
>=20
> Pillow =3D 3.2.0
> plone.app.contenttypes =3D 1.1.1
> plone.app.discussion =3D 2.2.18
> plone.app.event =3D 1.1.6
> Products.CMFPlone =3D 4.3.10
> Products.PloneFormGen =3D 1.7.19
> On Plone 5.0:
>=20
> mockup =3D 2.1.5
> Pillow =3D 3.2.0
> plone.app.contenttypes =3D 1.2.15
> plone.app.discussion =3D 2.4.16
> plone.app.event =3D 2.0.10
> Products.CMFPlone =3D 5.0.5
> Products.PloneFormGen =3D 1.8.1
> Questions and Support
>=20
> For questions and help with these updates, please see =
plone.org/support <https://plone.org/support>=
--Apple-Mail=_360CF2D8-7518-439E-859C-C84A610113B8
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><base class=3D""><div =
class=3D"Apple-Mail-URLShareUserContentTopClass"><br class=3D""></div><div=
class=3D"Apple-Mail-URLShareWrapperClass" style=3D"position: relative =
!important;"><blockquote type=3D"cite" style=3D"border-left-style: none; =
color: inherit; padding: inherit; margin: inherit;" class=3D""><div =
class=3D""><div class=3D"original-url"><a =
href=3D"https://plone.org/news/2016/minor-plone-security-fixes" =
class=3D"">https://plone.org/news/2016/minor-plone-security-fixes</a><br =
class=3D""><br class=3D""></div><div id=3D"article" role=3D"article" =
style=3D"-webkit-locale: en; border-bottom-width: 0px;" class=3D"">
<!-- This node will contain a number of div.page. -->
<div class=3D"page"><h1 class=3D"title">Minor Plone Security =
Fixes</h1><header class=3D""><p class=3D"">The Plone Security Team has =
released new versions of several packages. These new versions remedy =
several security-related issues, none of which were significant enough =
to warrant a full security hotfix.</p>
=20
</header><p class=3D"">Issues and version updates are detailed =
below. You may use the new versions in your Plone installation by <a =
href=3D"http://docs.plone.org/manage/installing/installing_addons.html?hig=
hlight=3Dpin#pinning-add-on-versions" class=3D"">adding =E2=80=9Cpinning=E2=
=80=9D version numbers to your buildout</a>.</p><p class=3D"">The new =
versions include releases of Pillow (provided by the Pillow =
security team) and PloneFormGen (provided by the PloneFormGen =
maintainers).</p>
<h2 class=3D"">Plone release</h2>
<ul class=3D"">
<li class=3D"">All fixes mentioned below in the other packages, are =
included in new Plone releases. So if you can update your site in =
the normal way to one of these versions, that is best. Please =
apply the normal procedures you use for updating your site. This =
should include testing the upgrade on a copy of your site.</li>
<li class=3D"">Exception: Products.PloneFormgen is an add-on that is not =
included in the core versions of Plone. You need to update this =
explicitly.</li>
<li class=3D"">Plone 4.2 or earlier: no new versions list is made =
available.</li>
<li class=3D"">Plone 4.3: extend <a =
href=3D"http://dist.plone.org/release/4.3.10/versions.cfg" =
class=3D"">http://dist.plone.org/release/4.3.10/versions.cfg</a> or use =
the installer.</li>
<li class=3D"">Plone 5.0: extend <a =
href=3D"http://dist.plone.org/release/5.0.5/versions.cfg" =
class=3D"">http://dist.plone.org/release/5.0.5/versions.cfg</a> or use =
the installer.</li>
</ul>
<h2 class=3D"">plone.app.discussion</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: Cross Site Scripting (XSS) =
attack on comment moderation page.</li>
<li class=3D"">Affected: this only affects you if you have enabled =
commenting, and have enabled comment moderation, and are using plain =
text or intelligenttext as comment format. The only spot where you =
are vulnerable, is on the comment moderation page. So regular =
visitors of your site have nothing to fear. If you have enabled =
anonymous commenting, this attack is open for anyone, which makes this =
the most serious one.</li>
<li class=3D"">Workaround: Switch to MarkDown or html as comment format. =
Because existing comments may still be affected: use the =
moderation options on the page where the comment appears. Or use =
the moderation page with javascript turned off.</li>
<li class=3D"">Plone 4.0 or earlier: not affected, because =
plone.app.discussion is not included in the core.</li>
<li class=3D"">Plone 4.1, 4.2: use plone.app.discussion 2.1.2</li>
<li class=3D"">Plone 4.3: use plone.app.discussion 2.2.18</li>
<li class=3D"">Plone 5.0: use plone.app.discussion 2.4.16</li>
</ul>
<h2 class=3D"">Products.CMFPlone (1)</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: exposing properties of the site =
to anonymous users. We mean properties from the Properties tab in =
the Zope Management Interface, or from the portal_properties tool.</li>
<li class=3D"">Affected: this affects everyone. In standard Plone =
nothing very interesting can be seen. But if you have an add-on or =
own code that stores a secret key here, anonymous users can view =
this.</li>
<li class=3D"">Workaround: do not use the properties to store info that =
needs to remain secret. The configuration registry is a much =
better place for this.</li>
<li class=3D"">Plone 4.2 or earlier: no fix is issued.</li>
<li class=3D"">Plone 4.3 or earlier: use Products.CMFPlone 4.3.10</li>
<li class=3D"">Plone 5.0: use Products.CMFPlone 5.0.5</li>
</ul>
<h2 class=3D"">Products.CMFPlone (2)</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: Cross Site Scripting (XSS) =
attack in any field that uses the select2 pattern. By default =
these are the contributors, creators, and tag fields.</li>
<li class=3D"">Affected: this affects you if untrusted or compromised =
users can create or edit content. You are only vulnerable when =
editing content.</li>
<li class=3D"">Workaround: use the edit pages with javascript turned off =
(which admittedly is not nice).</li>
<li class=3D"">Plone 4.3 or earlier: not affected</li>
<li class=3D"">Plone 5.0: use Products.CMFPlone 5.0.5</li>
</ul>
<h2 class=3D"">mockup</h2>
<ul class=3D"">
<li class=3D"">This is the same vulnerability as in Products.CMFPlone =
(2). The mockup package is only used when you are compiling =
javascript resources in the new resource registries control panel.</li>
<li class=3D"">Plone 4.3 or earlier: not affected</li>
<li class=3D"">Plone 5.0: use mockup 2.1.5</li>
</ul>
<h2 class=3D"">plone.app.event</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: Cross Site Scripting (XSS) =
attack in location field of Events.</li>
<li class=3D"">Affected: this affects you if untrusted or compromised =
users can create or edit Events.</li>
<li class=3D"">Note: these are the dexterity events. Plone 4 does =
not ship with this, but you may have added it.</li>
<li class=3D"">Plone 4.2 or earlier: plone.app.event is not used by =
default. If you do use it, you probably know what you are =
doing.</li>
<li class=3D"">Plone 4.3: use plone.app.event 1.1.6 (if your site uses =
this package). Note: if you had custom code to override the =
`get_location` view helper method to return html, this no longer works. =
For plain text it still works fine, but the `get_location` method =
is gone in version 2.0, for simplicity. Instead you can override =
the necessary templates in your add-ons.</li>
<li class=3D"">Plone 5.0: use plone.app.event 2.0.10</li>
</ul>
<h2 class=3D"">plone.app.contenttypes</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: Cross Site Scripting (XSS) =
attack in the caption field of the leadimage behavior.</li>
<li class=3D"">Affected: this affects you if untrusted or compromised =
users can create or edit content. By default only News Items use =
the leadimage behavior, but this behavior may have been enabled on other =
types.</li>
<li class=3D"">Note: this is a package with dexterity content types. =
Plone 4 does not ship with this, but you may have added it. =
Archetypes News Items are not affected.</li>
<li class=3D"">Note: there is also the collective.contentleadimage =
package, which does a similar thing for Archetypes content, but this is =
not affected.</li>
<li class=3D"">Plone 4.2 or earlier: plone.app.contenttypes is not used =
by default. If you do use it, you probably know what you are =
doing.</li>
<li class=3D"">Plone 4.3: use plone.app.contenttypes 1.1.1. Note =
that only news items are affected, because the leadimage caption is not =
shown in the behavior.</li>
<li class=3D"">Plone 5.0: use plone.app.contenttypes 1.2.15</li>
</ul>
<h2 class=3D"">Products.PloneFormGen</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: The 'help' field of form fields =
was not HTML escaped, allowing it to be used for an XSS attack.</li>
<li class=3D"">Affected: this only affects you if you allow untrusted or =
compromised users to create forms.</li>
<li class=3D"">For more info, see <a =
href=3D"https://github.com/smcmahon/Products.PloneFormGen/blob/master/CHAN=
GES.txt" =
class=3D"">https://github.com/smcmahon/Products.PloneFormGen/blob/master/C=
HANGES.txt</a></li>
<li class=3D"">On Plone 4.1 and higher, update to Products.PloneFormGen =
1.7.19.</li>
<li class=3D"">On Plone 5.0 and higher, update to Products.PloneFormGen =
1.8.1.</li>
</ul>
<h2 class=3D"">Pillow</h2>
<ul class=3D"">
<li class=3D"">Nature of vulnerability: When an attacker uploads a =
specially crafted image, the Plone Site may crash. Theoretically =
he may get access to other parts of the memory of your machine, due to a =
buffer overflow.</li>
<li class=3D"">Affected: this only affects you if you allow untrusted or =
compromised users to upload images.</li>
<li class=3D"">For more info, see <a =
href=3D"http://pillow.readthedocs.io/en/3.2.x/releasenotes/index.html" =
class=3D"">http://pillow.readthedocs.io/en/3.2.x/releasenotes/index.html</=
a></li>
<li class=3D"">You might be using PIL or PILwoTk instead of Pillow, but =
they have basically the same problem.</li>
<li class=3D"">On Plone 4.0 and higher, update to Pillow 3.1.2 or =
3.2.0.</li>
<li class=3D"">On Plone 3 you need to use Python 2.4, and the latest =
compatible Pillow version is 1.7.0, which may be vulnerable. There =
is no fix here. Note that both Plone 3 and Python 2.4 are not =
getting security updates anymore.</li>
</ul>
<h2 class=3D"">Versions</h2><p class=3D"">These are the versions that =
you should update in the `[versions]` section of your buildout.cfg =
configuration file: </p>
<h3 class=3D"">On Plone 4.0:</h3>
<div class=3D"scrollable"><pre class=3D"">Pillow =3D 3.2.0<br =
class=3D"">Products.PloneFormGen =3D 1.7.19 </pre></div>
<h3 class=3D"">On Plone 4.1 and 4.2:</h3>
<div class=3D"scrollable"><pre class=3D"">Pillow =3D 3.2.0<br =
class=3D"">plone.app.discussion =3D 2.1.2<br =
class=3D"">Products.PloneFormGen =3D 1.7.19</pre></div>
<h3 class=3D"">On Plone 4.3:</h3>
<div class=3D"scrollable"><pre class=3D"">Pillow =3D 3.2.0<br =
class=3D"">plone.app.contenttypes =3D 1.1.1<br =
class=3D"">plone.app.discussion =3D 2.2.18<br class=3D"">plone.app.event =
=3D 1.1.6<br class=3D"">Products.CMFPlone =3D 4.3.10<br =
class=3D"">Products.PloneFormGen =3D 1.7.19</pre></div>
<h3 class=3D"">On Plone 5.0:</h3>
<div class=3D"scrollable"><pre class=3D"">mockup =3D 2.1.5<br =
class=3D"">Pillow =3D 3.2.0<br class=3D"">plone.app.contenttypes =3D =
1.2.15<br class=3D"">plone.app.discussion =3D 2.4.16<br =
class=3D"">plone.app.event =3D 2.0.10<br class=3D"">Products.CMFPlone =3D =
5.0.5<br class=3D"">Products.PloneFormGen =3D 1.8.1</pre></div>
<h2 class=3D"">Questions and Support</h2><p class=3D"">For questions and =
help with these updates, please see <a data-val=3D"/support" =
href=3D"https://plone.org/support" data-linktype=3D"external" =
title=3D"Plone support" =
class=3D"">plone.org/support</a></p></div></div></div></blockquote></div><=
/body></html>=
--Apple-Mail=_360CF2D8-7518-439E-859C-C84A610113B8--
--===============4192740325117494070==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
--===============4192740325117494070==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Plone-Announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-announce
--===============4192740325117494070==--