New Waitress version, and updated 20 200121 hotfix — Plone: Enterprise Level CMS - Free an d OpenSource - Community Driven - Secure

--===============6311299501010528554==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_96FB6653-92F7-4D5E-B7B9-BC7EEA3B024A"


--Apple-Mail=_96FB6653-92F7-4D5E-B7B9-BC7EEA3B024A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


>=20
> =
https://plone.org/security/announcements/new-waitress-version-and-updated-=
20200121-hotfix =
<https://plone.org/security/announcements/new-waitress-version-and-updated=
-20200121-hotfix>
>=20
> New Waitress version, and updated 20200121 hotfix
>=20
> An update to Waitress, and improved SQL escaping in the 20200121 =
hotfix
>=20
> Waitress
>=20
> If you use Waitress, please upgrade from 1.4.2 to 1.4.3.=20
>=20
> The Pylons Project released a new version of Waitress to fix a bug in =
the regular expression that was used to parse HTTP headers. The bug =
could cause the waitress process to use excessive CPU.
>=20
> As Plone 5.2.1 uses Waitress 1.4.2, we recommend changing the version =
pin to 1.4.3 in your buildout.
>=20
> [versions]
> waitress =3D 1.4.3
> Updated 20200121 Hotfix
>=20
> As announced previously =
<https://plone.org/security/announcements/security-patch-released-20200121=
>, the 20200121 hotfix <https://plone.org/security/hotfix/20200121> =
includes several fixes for privilege escalation, open redirect, password =
strength, overwriting files, SQL injection, and cross site scripting.
>=20
> Version 1.1 <https://plone.org/security/hotfix/20200121>, released on =
February 11, 2020, includes an update for the SQL Injection fix, which =
will not be needed for all installations.
>=20
> If you are not using SQL in your website you do NOT need to upgrade, =
though you can if you want to. Default Plone does not need it. Upgrading =
to this version is especially recommended when you use PostgreSQL. Note =
that RelStorage is not affected. For details and discussion, see =
DocumentTemplate issue #48 =
<https://github.com/zopefoundation/DocumentTemplate/issues/48>.=20
>=20
> Installation
>=20
> Full installation instructions are available on the HotFix release =
page <https://plone.org/security/hotfix/20200121>.
>=20
> Standard security advice
>=20
> Make sure that the Zope/Plone service is running with minimum =
privileges. Ideally, the Zope and ZEO services should be able to write =
only to log and data directories. Plone sites installed through our =
installers already do this.
> Use an intrusion detection system that monitors key system resources =
for unauthorized changes.
> Monitor your Zope, reverse-proxy request and system logs for unusual =
activity.
> Make sure your administrator stays up to date, by following the =
special low-volume Plone Security Announcements list via email =
<https://lists.sourceforge.net/lists/listinfo/plone-announce>, RSS  =
<https://plone.org/security/announcements/RSS>and/or Twitter =
<https://twitter.com/plone>
> These are standard precautions that should be employed on any =
production system, and are not tied to this fix.
>=20
> Extra Help
>=20
> If you do not have in-house server administrators or a service =
agreement for supporting your website, you can find consulting companies =
at plone.com/providers <http://plone.com/providers>
> There is also free support=C2=A0 <https://plone.org/support>available =
online via the Plone forum <https://community.plone.org/> and the Plone =
chat=C2=A0channels <https://plone.org/support/chat>.
>=20
> Q: When will the patch be made available?
> A: The Plone Security Team released the update patch on =
2020-02-11T22:47:25+0000.
>=20
> Q. What will be involved in applying the patch?
> A. Patches are made available as tarball-style archives that may be =
unpacked into the products folder of a buildout installation (for Plone =
5.1.x and earlier only) and as Python packages that may be installed by =
editing a buildout configuration file and running buildout. Patching is =
generally easy and quick to accomplish.
>=20
> Q: How were these vulnerabilities found?
> A: The vulnerabilities were found by users submitting them to the =
security mailing list.
>=20
> Q: My site is highly visible and mission-critical. I hear the patch =
has already been developed. Can I get the fix before the release date?
> A: No. The patch will be made available to all administrators at the =
same time. There are no exceptions.
>=20
> Q: If the patch has been developed already, why isn't it made =
available to the public now?
> A: The Security Team is still testing the patch against a wide variety =
of configurations and running various scenarios thoroughly. The team is =
also making sure everybody has appropriate time to plan to patch their =
Plone installation(s). Some consultancy organizations have hundreds of =
sites to patch and need the extra time to coordinate their efforts with =
their clients.
>=20
> Q: How does one exploit the vulnerability?
> A: This information will not be made public until after the patch is =
made available.
>=20
> Q: Is my Plone site at risk for this vulnerability? How do I know if =
my site has been exploited? How can I confirm that the hotfix is =
installed correctly and my site is protected?
>=20
> A: Details about the vulnerability will be revealed at the same time =
as the patch.
>=20
> Q: How can I report other potential security vulnerabilities?
>=20
> A: Please email the Plone Security Team at security-z4DKO/[email protected] =
<mailto:security-z4DKO/[email protected]> rather than publicly discussing potential =
security issues.
>=20
> Q: How can I apply the patch without affecting my users?
>=20
> A: Even though this patch does NOT require you to run buildout, you =
can run buildout without affecting your users. You can restart a =
multi-client Plone install without affecting your users; see =
http://docs.plone.org/manage/deploying/processes.html =
<http://docs.plone.org/manage/deploying/processes.html> =20
>=20
> Q: How do I get help patching my site?
>=20
> A: Plone service providers are listed at plone.com/providers=C2=A0 =
<http://plone.com/providers> There is also free support=C2=A0 =
<https://plone.org/support>available online via the Plone=C2=A0forum =
<https://community.plone.org/> and the Plone chat=C2=A0channels =
<https://plone.org/support/chat>
> Q: Who is on the Plone Security Team and how is it funded?
>=20
> A: The Plone Security Team =
<https://plone.org/community/security/security> is made up of volunteers =
who are experienced developers familiar with the Plone code base and =
with security exploits. The Plone Security Team is not funded; members =
and/or their employers have volunteered their time in the interests of =
the greater Plone community.
>=20
> Q: How can I help the Plone Security Team?
>=20
> A: The Plone Security Team is looking for help from security-minded =
developers and testers. Volunteers must be known to the Security Team =
and have been part of the Plone community for some time. To help the =
Security Team financially, your donations are most welcome at =
http://plone.org/sponsors <https://plone.org/sponsors>
> General questions about this announcement, Plone patching procedures, =
and availability of support may be addressed to the Plone support forums =
<https://plone.org/support> If you have specific questions about this =
vulnerability or its handling, contact the Plone Security Team at =
security-z4DKO/[email protected] <mailto:security-z4DKO/[email protected]>
> To report potentially security-related issues, email the Plone =
Security Team at security-z4DKO/[email protected] <mailto:security-z4DKO/[email protected]> We are =
always happy to credit individuals and companies who make responsible =
disclosures.
>=20
> Information for Vulnerability Database Maintainers
>=20
> We will apply for CVE numbers for these issues. Further information on =
individual vulnerabilities (including CVSS scores, CWE identifiers and =
summaries) will be available at the full vulnerability list. =
<https://plone.org/hotfixes>=

--Apple-Mail=_96FB6653-92F7-4D5E-B7B9-BC7EEA3B024A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
 class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><br =
class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""><a =
href=3D"https://plone.org/security/announcements/new-waitress-version-and-=
updated-20200121-hotfix" =
class=3D"">https://plone.org/security/announcements/new-waitress-version-a=
nd-updated-20200121-hotfix</a><br class=3D""><br class=3D""></div><div =
id=3D"article" role=3D"article" style=3D"text-rendering: =
optimizeLegibility; font-family: -apple-system-font; font-size: 1.2em; =
line-height: 1.5em; margin: 0px; padding: 0px;" class=3D"system =
exported">
        <!-- This node will contain a number of div.page. -->
    <div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: =
1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: 100%;">New =
Waitress version, and updated 20200121 hotfix</h1><h2 class=3D"subhead" =
style=3D"font-weight: normal; color: rgba(27, 27, 27, 0.65098); =
font-size: 1.46664em; margin-top: -0.35em; line-height: 1.27275em; =
max-width: 100%;">An update to Waitress, and improved SQL escaping in =
the 20200121 hotfix</h2>
<h2 style=3D"font-size: 1.43em; max-width: 100%;" =
class=3D"">Waitress</h2><p style=3D"max-width: 100%;" class=3D"">If you =
use Waitress, please upgrade from 1.4.2 to 1.4.3.&nbsp;</p><p =
style=3D"max-width: 100%;" class=3D"">The&nbsp;Pylons Project released a =
new version of Waitress to fix a bug in the regular expression that was =
used to parse HTTP headers. The bug could cause the waitress process to =
use excessive CPU.</p><p style=3D"max-width: 100%;" class=3D"">As Plone =
5.2.1 uses Waitress 1.4.2, we recommend changing the version pin to =
1.4.3 in your buildout.</p>
<div class=3D"scrollable" style=3D"max-width: 100%; overflow-x: scroll; =
word-wrap: normal;"><pre style=3D"max-width: 100%; font-family: =
-apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: =
1.45em;" class=3D"">[versions]
waitress =3D 1.4.3</pre></div>
<h2 style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Updated =
20200121 Hotfix</h2><p style=3D"max-width: 100%;" class=3D"">As <a =
href=3D"https://plone.org/security/announcements/security-patch-released-2=
0200121" style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">announced previously</a>, the <a =
href=3D"https://plone.org/security/hotfix/20200121" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">20200121 hotfix</a> =
includes several fixes for privilege escalation, open redirect, password =
strength, overwriting files, SQL injection, and cross site =
scripting.</p><p style=3D"max-width: 100%;" class=3D""><a =
href=3D"https://plone.org/security/hotfix/20200121" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">Version 1.1</a>, =
released on February 11, 2020, includes an update for the SQL Injection =
fix, which will not be needed for all installations.</p><p =
style=3D"max-width: 100%;" class=3D"">If you are not using SQL in your =
website you do NOT need to upgrade, though you can if you want to. =
Default Plone does not need it. Upgrading to this version is especially =
recommended when you use PostgreSQL. Note that RelStorage is not =
affected. For details and discussion, see <a =
href=3D"https://github.com/zopefoundation/DocumentTemplate/issues/48" =
style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">DocumentTemplate issue #48</a>.&nbsp;</p>
<h2 style=3D"font-size: 1.43em; max-width: 100%;" =
class=3D"">Installation</h2><p style=3D"max-width: 100%;" class=3D"">Full =
installation instructions are available on&nbsp;<a =
href=3D"https://plone.org/security/hotfix/20200121" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">the HotFix release =
page</a>.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Standard =
security advice</h3>
<ul style=3D"max-width: 100%;" class=3D"">
<li style=3D"max-width: 100%;" class=3D"">Make sure that the Zope/Plone =
service is running with minimum privileges. Ideally, the Zope and ZEO =
services should be able to write only to log and data directories. Plone =
sites installed through our installers already do this.</li>
<li style=3D"max-width: 100%;" class=3D"">Use an intrusion detection =
system that monitors key system resources for unauthorized changes.</li>
<li style=3D"max-width: 100%;" class=3D"">Monitor your Zope, =
reverse-proxy request and system logs for unusual activity.</li>
<li style=3D"max-width: 100%;" class=3D"">Make sure your administrator =
stays up to date, by following the special low-volume <a title=3D"" =
href=3D"https://lists.sourceforge.net/lists/listinfo/plone-announce" =
target=3D"_self" style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">Plone Security Announcements list via email</a>, <a =
href=3D"https://plone.org:443/security/announcements/RSS" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">RSS </a>and/or <a =
title=3D"" href=3D"https://twitter.com/plone" target=3D"_self" =
style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">Twitter</a></li>
</ul><p style=3D"max-width: 100%;" class=3D"">These are standard =
precautions that should be employed on any production system, and are =
not tied to this fix.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Extra =
Help</h3><p style=3D"max-width: 100%;" class=3D"">If you do not have =
in-house server administrators or a service agreement for supporting =
your website, you can find consulting companies at&nbsp;<a =
href=3D"http://plone.com/providers" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">plone.com/providers</a></p><p =
style=3D"max-width: 100%;" class=3D"">There is also&nbsp;<a =
href=3D"https://plone.org/../support" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">free support&nbsp;</a>available online via =
the <a href=3D"https://community.plone.org" style=3D"color: rgb(65, 110, =
210); max-width: 100%;" class=3D"">Plone forum</a>&nbsp;and the <a =
href=3D"https://plone.org/support/chat" style=3D"color: rgb(65, 110, =
210); max-width: 100%;" class=3D"">Plone chat&nbsp;channels</a>.</p><p =
style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" =
class=3D"">Q: When will the patch be made available?<br =
style=3D"max-width: 100%;" class=3D""></strong>A: The Plone Security =
Team released the update patch on&nbsp;2020-02-11T22:47:25+0000.</p><p =
style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" =
class=3D"">Q. What will be involved in applying the patch?<br =
style=3D"max-width: 100%;" class=3D""></strong>A. Patches are made =
available as tarball-style archives that may be unpacked into the <kbd =
style=3D"max-width: 100%;" class=3D"">products</kbd> folder of a =
buildout installation (for Plone 5.1.x and earlier only) and as Python =
packages that may be installed by editing a buildout configuration file =
and running buildout. Patching is generally easy and quick to =
accomplish.</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: How were these vulnerabilities =
found?<br style=3D"max-width: 100%;" class=3D""></strong>A: The =
vulnerabilities were found by users submitting them to the security =
mailing list.</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: My site is highly visible and =
mission-critical. I hear the patch has already been developed. Can I get =
the fix before the release date?</strong><br style=3D"max-width: 100%;" =
class=3D"">A: No. The patch will be made available to <strong =
style=3D"max-width: 100%;" class=3D"">all administrators at the same =
time</strong>. There are no exceptions.</p><p style=3D"max-width: 100%;" =
class=3D""><strong style=3D"max-width: 100%;" class=3D"">Q: If the patch =
has been developed already, why isn't it made available to the public =
now?<br style=3D"max-width: 100%;" class=3D""></strong> A: The Security =
Team is still testing the patch against a wide variety of configurations =
and running various scenarios thoroughly. The team is also making sure =
everybody has appropriate time to plan to patch their Plone =
installation(s). Some consultancy organizations have hundreds of sites =
to patch and need the extra time to coordinate their efforts with their =
clients.</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: How does one exploit the =
vulnerability?<br style=3D"max-width: 100%;" class=3D""></strong>A: This =
information will not be made public until after the patch is made =
available.</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: Is my Plone site at risk for =
this vulnerability?</strong><strong style=3D"max-width: 100%;" =
class=3D"">&nbsp;How do I know if my site has been =
exploited?</strong><strong style=3D"max-width: 100%;" class=3D"">&nbsp;How=
 can I confirm that the hotfix is installed correctly and my site is =
protected?</strong></p><p style=3D"max-width: 100%;" class=3D"">A: =
Details about the vulnerability will be revealed at the same time as the =
patch.</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: How can I report other =
potential security vulnerabilities?</strong></p><p style=3D"max-width: =
100%;" class=3D"">A: Please email the Plone Security Team at&nbsp;<a =
href=3D"mailto:security-z4DKO/[email protected]" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">security-z4DKO/[email protected]</a>&nbsp;rather than =
publicly discussing potential security issues.</p><p style=3D"max-width: =
100%;" class=3D""><strong style=3D"max-width: 100%;" class=3D"">Q: How =
can I apply the patch without affecting my users?</strong></p><p =
style=3D"max-width: 100%;" class=3D"">A: Even though this patch does NOT =
require you to run buildout, you can run buildout without affecting your =
users. You can restart a multi-client Plone install without affecting =
your users; see&nbsp;<a =
href=3D"http://docs.plone.org/manage/deploying/processes.html" =
style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">http://docs.plone.org/manage/deploying/processes.html</a>&nbsp;=
&nbsp;</p><p style=3D"max-width: 100%;" class=3D""><strong =
style=3D"max-width: 100%;" class=3D"">Q: How do I get help patching my =
site?</strong></p><p style=3D"max-width: 100%;" class=3D"">A: Plone =
service providers are listed at&nbsp;<a =
href=3D"http://plone.com/providers" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">plone.com/providers&nbsp;</a> There is =
also&nbsp;<a href=3D"https://plone.org/../support" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">free =
support&nbsp;</a>available online via the <a =
href=3D"https://community.plone.org" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">Plone&nbsp;forum</a>&nbsp;and the <a =
href=3D"https://plone.org/support/chat" style=3D"color: rgb(65, 110, =
210); max-width: 100%;" class=3D"">Plone chat&nbsp;channels</a></p><p =
style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" =
class=3D"">Q: Who is on the Plone Security Team and how is it =
funded?</strong></p><p style=3D"max-width: 100%;" class=3D"">A: The <a =
href=3D"https://plone.org/community/security/security" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" class=3D"">Plone Security Team</a> =
is made up of volunteers who are experienced developers familiar with =
the Plone code base and with security exploits. The Plone Security Team =
is not funded; members and/or their employers have volunteered their =
time in the interests of the greater Plone community.</p><p =
style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" =
class=3D"">Q: How can I help the Plone Security Team?</strong></p><p =
style=3D"max-width: 100%;" class=3D"">A: The Plone Security Team is =
looking for help from&nbsp;security-minded developers and testers. =
Volunteers must be known to the Security Team and have been part of the =
Plone community for some time. To help the Security Team financially, =
your donations are most welcome at <a target=3D"_blank" =
href=3D"https://plone.org/sponsors" rel=3D"noopener" style=3D"color: =
rgb(65, 110, 210); max-width: 100%;" =
class=3D"">http://plone.org/sponsors</a></p><p style=3D"max-width: =
100%;" class=3D""><strong style=3D"max-width: 100%;" class=3D"">General =
questions about this announcement</strong>, Plone patching procedures, =
and availability of support may be addressed to the&nbsp;<a =
href=3D"https://plone.org/../support" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">Plone support forums</a>&nbsp;If you =
have&nbsp;specific questions&nbsp;about this vulnerability or its =
handling, contact the&nbsp;Plone Security Team at&nbsp;<a =
href=3D"mailto:security-z4DKO/[email protected]" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">security-z4DKO/[email protected]</a></p><p =
style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" =
class=3D"">To report potentially security-related =
issues</strong>,&nbsp;email the Plone Security Team at&nbsp;<a =
href=3D"mailto:security-z4DKO/[email protected]" style=3D"color: rgb(65, 110, 210); =
max-width: 100%;" class=3D"">security-z4DKO/[email protected]</a>&nbsp;We are always =
happy to credit individuals and companies who make responsible =
disclosures.</p>
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">Information =
for Vulnerability Database Maintainers</h3><p style=3D"max-width: 100%;" =
class=3D"">We will apply for CVE numbers for these issues. Further =
information on individual vulnerabilities (including CVSS scores, CWE =
identifiers and summaries) will be available at&nbsp;<a =
href=3D"https://plone.org/../hotfixes" style=3D"color: rgb(65, 110, =
210); max-width: 100%;" class=3D"">the full vulnerability =
list.</a></p></div></div></div></blockquote></div></body></html>=

--Apple-Mail=_96FB6653-92F7-4D5E-B7B9-BC7EEA3B024A--


--===============6311299501010528554==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============6311299501010528554==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Want community news? Subscribe to our newsletter http://eepurl.com/S4wfL

Plone-Announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-announce
--===============6311299501010528554==--