Security patch 20210518 version 1.4 released — Plone: Enterprise Level CMS - Free and Ope nSource - Community Driven - Secure
"Important Announcements, Plone releases, and security-related notifications. Recommended subscription for all Plone developers and site admins" <[email protected]> Mon, 14 Jun 2021 11:01:02 -0500
| Newsgroups | gmane.comp.web.zope.plone.announce |
|---|---|
| Message-ID | <[email protected]> |
--===============2088130246138229008== Content-Type: multipart/alternative; boundary="Apple-Mail=_EE282C6E-451A-46EE-AA44-5BEB23976816" --Apple-Mail=_EE282C6E-451A-46EE-AA44-5BEB23976816 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 h= ttps://plone.org/security/announcements/security-patch-released-20210518 = <https://plone.org/security/announcements/security-patch-released-20210518= > >=20 > Security patch 20210518 version 1.4 released >=20 > Version 1.4 of the hotfix to patch various vulnerabilities. This = hotfix is recommended for Plone 4.3, 5.0, 5.1 and 5.2. >=20 > This is a routine patch. There is no evidence that the issues fixed = here are being used against any sites. >=20 > Version 1.4 of the hotfix is available from: >=20 > https://plone.org/security/hotfix/20210518 = <https://plone.org/security/hotfix/20210518> =E2=80=93 if you grab the = zip from here, please check that the version.txt contains 1.4 and/or = that the md5/sha sum matches. You may get an older version from the = cache. Try adding ?x=3D1 to the URL if this happens.=20 > https://pypi.org/project/Products.PloneHotfix20210518/ = <https://pypi.org/project/Products.PloneHotfix20210518/> =20 > Recommended for all. =46rom the changelog: >=20 > 1.4 (2021-06-08) >=20 > Use safe html transform instead of escape for richtext diff. Otherwise = the inline diff is not inline anymore. > (Note: I forgot to add this to the changelog on PyPI/plone.org). >=20 > With PLONEHOTFIX20210518_NAMEDFILE_USE_DENYLIST=3D1 in the OS = environment, use a denylist for determining which mimetypes can be = displayed inline. > By default we use an allowlist with the most used image types, plain = text, and PDF. > The denylist contains svg, javascript, and html, which have known = cross site scripting possibilities. >=20 > By popular request, allow showing PDF files inline. > Note: browser preference plays a part in what actually happens. >=20 > In untrusted path expressions with modules, check that each module is = allowed. > In the first version of the hotfix we disallowed modules that were = available as a 'private' alias, for example random._itertools. > But if random.itertools without underscore would have been available, = it was still allowed, even though itertools has not been explicitly = allowed. > (itertools might be fine to allow, it is just an example.) > This version is a recommended upgrade for all users. >=20 > CVE numbers: CVE numbers have been assigned; see the individual pages. >=20 > Versions Affected: All supported Plone versions (4.3.20 and any = earlier 4.3.x version, 5.2.4 and any earlier 5.x version). >=20 > Versions Not Affected: None. >=20 > Nature of vulnerabilities: >=20 > The patch will address several security issues: >=20 > Remote Code Execution via traversal in expressions. Reported by David = Miller. > Writing arbitrary files via docutils and Python Script. Reported by = Calum Hutton. > Various information disclosures: mostly installation logs. Reported by = Calum Hutton. > Stored XSS from file upload (svg, html). Reported separately by Emir = C=C3=BCneyt Akkutlu and Tino Kautschke. > Reflected XSS in various spots. Reported by Calum Hutton. > XSS vulnerability in CMFDiffTool. Reported by Igor Margitich. > Stored XSS from user fullname. Reported by Tino Kautschke. > Blind SSRF via feedparser accessing an internal URL. Reported by = Subodh Kumar Shree. > Server Side Request Forgery via event ical URL. Reported by MisakiKata = and David Miller. > Server Side Request Forgery via lxml parser. Reported by MisakiKata = and David Miller. > Thank you to all who contacted the Plone security team = <mailto:security-z4DKO/[email protected]> to report problems! >=20 > Version support: The hotfix is officially supported by the Plone = security team on the following versions of Plone in accordance with the = Plone=C2=A0version support policy = <https://plone.org/security/update-policy>: 4.3.20, 5.0.10, 5.1.7, = 5.2.4. Previous versions, like 4.2, could be affected but have not been = tested. On such old versions, the hotfix might have worse side effects = than what it tries to fix. >=20 > The fixes included here will be incorporated into subsequent releases = of Plone, so Plone 5.2.5 and greater should not require this hotfix.=20 >=20 > Warning: The hotfix has not been tested with Python 2.6. Originally = Plone 4.3 was supported on Python 2.6, but since a few releases this is = no longer the case since. It gets ever more difficult to test on Python = 2.6. By now, you may have trouble installing any package with Python = 2.6. >=20 > The patch was released at 2021-05-18 15:00 UTC = <http://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=3D2021&mo=3D05&= d=3D18&h=3D15&mn=3D0>. >=20 > Installation >=20 > Full installation instructions are available on the HotFix release = page <https://plone.org/security/hotfix/20210518>. >=20 > Standard security advice >=20 > Make sure that the Zope/Plone service is running with minimum = privileges. Ideally, the Zope and ZEO services should be able to write = only to log and data directories. Plone sites installed through our = installers already do this. > Use an intrusion detection system that monitors key system resources = for unauthorized changes. > Monitor your Zope, reverse-proxy request and system logs for unusual = activity. > Make sure your administrator stays up to date, by following the = special low-volume Plone Security Announcements list via email = <https://lists.sourceforge.net/lists/listinfo/plone-announce>, RSS = <https://plone.org/security/announcements/RSS>and/or Twitter = <https://twitter.com/plone> > These are standard precautions that should be employed on any = production system, and are not tied to this fix. >=20 > Extra Help >=20 > If you do not have in-house server administrators or a service = agreement for supporting your website, you can find consulting companies = at plone.com/providers <http://plone.com/providers> > There is also free support=C2=A0 <https://plone.org/support>available = online via the Plone forum <https://community.plone.org/> and the Plone = chat=C2=A0channels <https://plone.org/support/chat>. >=20 > Q: When will the patch be made available? > A: The Plone Security Team released the patch at 2021-05-18 15:00 UTC = <http://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=3D2021&mo=3D05&= d=3D18&h=3D15&mn=3D0>. >=20 > Q. What will be involved in applying the patch? > A. Patches are made available as tarball-style archives that may be = unpacked into the products folder of a buildout installation (for Plone = 5.1.x and earlier only) and as Python packages that may be installed by = editing a buildout configuration file and running buildout. Patching is = generally easy and quick to accomplish. >=20 > Q: How were these vulnerabilities found? > A: The vulnerabilities were found by users submitting them to the = security mailing list. >=20 > Q: My site is highly visible and mission-critical. I hear the patch = has already been developed. Can I get the fix before the release date? > A: No. The patch will be made available to all administrators at the = same time. There are no exceptions. >=20 > Q: If the patch has been developed already, why isn't it made = available to the public now? > A: The Security Team is still testing the patch against a wide variety = of configurations and running various scenarios thoroughly. The team is = also making sure everybody has appropriate time to plan to patch their = Plone installation(s). Some consultancy organizations have hundreds of = sites to patch and need the extra time to coordinate their efforts with = their clients. >=20 > Q: How does one exploit the vulnerability? > A: This information will not be made public until after the patch is = made available. >=20 > Q: Is my Plone site at risk for this vulnerability? How do I know if = my site has been exploited? How can I confirm that the hotfix is = installed correctly and my site is protected? >=20 > A: Details about the vulnerability will be revealed at the same time = as the patch. >=20 > Q: How can I report other potential security vulnerabilities? >=20 > A: Please email the Plone Security Team at security-z4DKO/[email protected] = <mailto:security-z4DKO/[email protected]> rather than publicly discussing potential = security issues. >=20 > Q: How can I apply the patch without affecting my users? >=20 > A: Even though this patch does NOT require you to run buildout, you = can run buildout without affecting your users. You can restart a = multi-client Plone install without affecting your users; see = http://docs.plone.org/manage/deploying/processes.html = <http://docs.plone.org/manage/deploying/processes.html> =20 >=20 > Q: How do I get help patching my site? >=20 > A: Plone service providers are listed at plone.com/providers=C2=A0 = <http://plone.com/providers> There is also free support=C2=A0 = <https://plone.org/support>available online via the Plone=C2=A0forum = <https://community.plone.org/> and the Plone chat=C2=A0channels = <https://plone.org/support/chat> > Q: Who is on the Plone Security Team and how is it funded? >=20 > A: The Plone Security Team = <https://plone.org/community/security/security> is made up of volunteers = who are experienced developers familiar with the Plone code base and = with security exploits. The Plone Security Team is not funded; members = and/or their employers have volunteered their time in the interests of = the greater Plone community. >=20 > Q: How can I help the Plone Security Team? >=20 > A: The Plone Security Team is looking for help from security-minded = developers and testers. Volunteers must be known to the Security Team = and have been part of the Plone community for some time. To help the = Security Team financially, your donations are most welcome at = http://plone.org/sponsors <https://plone.org/sponsors> > General questions about this announcement, Plone patching procedures, = and availability of support may be addressed to the Plone support forums = <https://plone.org/support> If you have specific questions about this = vulnerability or its handling, contact the Plone Security Team at = security-z4DKO/[email protected] <mailto:security-z4DKO/[email protected]> > To report potentially security-related issues, email the Plone = Security Team at security-z4DKO/[email protected] <mailto:security-z4DKO/[email protected]> We are = always happy to credit individuals and companies who make responsible = disclosures. >=20 > Information for Vulnerability Database Maintainers >=20 > We will apply for CVE numbers for these issues. Further information on = individual vulnerabilities (including CVSS scores, CWE identifiers and = summaries) will be available at the full vulnerability list. = <https://plone.org/hotfixes>= --Apple-Mail=_EE282C6E-451A-46EE-AA44-5BEB23976816 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"><base></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><meta= http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" = class=3D""><base class=3D""><div style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base= class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><a = href=3D"https://plone.org/security/announcements/security-patch-released-2= 0210518" = class=3D"">https://plone.org/security/announcements/security-patch-release= d-20210518</a></div><div = class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" = style=3D"border-left-style: none; color: inherit; padding: inherit; = margin: inherit;" class=3D""><div class=3D""><div = class=3D"original-url"><br class=3D""></div><div id=3D"article" = role=3D"article" style=3D"text-rendering: optimizeLegibility; = font-family: -apple-system-font; font-size: 1.2em; line-height: 1.5em; = margin: 0px; padding: 0px;" class=3D"system exported"> <!-- This node will contain a number of div.page. --> <div class=3D"page" style=3D"word-wrap: break-word; max-width: = 100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: = 1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: = 100%;">Security patch 20210518 version 1.4 released</h1><h2 = class=3D"subhead" style=3D"font-weight: normal; color: rgba(27, 27, 27, = 0.65); font-size: 1.46664em; margin-top: -0.35em; line-height: = 1.27275em; max-width: 100%;">Version 1.4 of the hotfix to patch various = vulnerabilities. This hotfix is recommended for Plone 4.3, 5.0, 5.1 and = 5.2.</h2><p style=3D"max-width: 100%;" class=3D""><em style=3D"max-width: = 100%;" class=3D"">This is a routine patch. There is no evidence that the = issues fixed here are being used against any = sites.</em></p></div></div></div></blockquote><blockquote type=3D"cite" = style=3D"border-left-style: none; padding: inherit; margin: inherit;" = class=3D""><div id=3D"article" role=3D"article" class=3D"system = exported" style=3D"text-rendering: optimizeLegibility; line-height: = 1.5em; margin: 0px; padding: 0px;"><span class=3D""><div = style=3D"word-wrap: break-word; max-width: 100%;" class=3D"page"><font = color=3D"#000000" class=3D""><p style=3D"font-family: = -apple-system-font; font-size: 1.2em; max-width: 100%;" class=3D"">Version= 1.4 of the hotfix is available from:</p><ul style=3D"max-width: 100%; = clear: both;" class=3D"clear"><li style=3D"max-width: 100%;" class=3D""><a= href=3D"https://plone.org/security/hotfix/20210518" style=3D"font-family:= -apple-system-font; font-size: 1.2em;" = class=3D"">https://plone.org/security/hotfix/20210518</a><font = face=3D"-apple-system-font" class=3D""><span style=3D"font-size: 1.2em;" = class=3D""> =E2=80=93 if you grab the zip from here, please check that = the </span></font><code style=3D"font-family: -apple-system-font; = font-size: 1.2em; max-width: 100%;" class=3D"">version.txt</code><font = face=3D"-apple-system-font" class=3D""><span style=3D"font-size: 1.2em;" = class=3D""> contains 1.4 and/or that the md5/sha sum matches. You = may get an older version from the cache. Try = adding </span></font><code style=3D"font-family: = -apple-system-font; font-size: 1.2em; max-width: 100%;" = class=3D"">?x=3D1</code><font face=3D"-apple-system-font" class=3D""><span= style=3D"font-size: 1.2em;" class=3D""> to the URL if this = happens. </span></font></li><li style=3D"max-width: 100%;" = class=3D""><font face=3D"-apple-system-font" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-size: 14.399999618530273px;" = class=3D""><a = href=3D"https://pypi.org/project/Products.PloneHotfix20210518/" = class=3D"">https://pypi.org/project/Products.PloneHotfix20210518/</a> = </span></font></li></ul></font></div></span></div></blockquote><bloc= kquote type=3D"cite" style=3D"border-left-style: none; color: inherit; = padding: inherit; margin: inherit;" class=3D""><div id=3D"article" = role=3D"article" class=3D"system exported" style=3D"text-rendering: = optimizeLegibility; font-family: -apple-system-font; font-size: 1.2em; = line-height: 1.5em; margin: 0px; padding: 0px;"><div class=3D"page" = style=3D"word-wrap: break-word; max-width: 100%;"><p style=3D"max-width: = 100%;" class=3D"">Recommended for all. =46rom the changelog:</p><h1 = style=3D"font-size: 1.5em; line-height: 1.4em; max-width: 100%;" = class=3D""><span class=3D"converted-anchor" style=3D"max-width: = 100%;"></span>1.4 (2021-06-08)</h1><ul class=3D"clear" style=3D"max-width:= 100%; clear: both;"><li style=3D"max-width: 100%;" class=3D""><p = style=3D"max-width: 100%;" class=3D"">Use safe html transform instead of = escape for richtext diff. Otherwise the inline diff is not inline = anymore.<br style=3D"max-width: 100%;" class=3D"">(Note: I forgot to add = this to the changelog on PyPI/<a href=3D"http://plone.org" = class=3D"">plone.org</a>).</p></li><li style=3D"max-width: 100%;" = class=3D""><p style=3D"max-width: 100%;" class=3D"">With <code = style=3D"max-width: 100%;" = class=3D"">PLONEHOTFIX20210518_NAMEDFILE_USE_DENYLIST=3D1</code> in = the OS environment, use a denylist for determining which mimetypes can = be displayed inline.<br style=3D"max-width: 100%;" class=3D"">By default = we use an allowlist with the most used image types, plain text, and = PDF.<br style=3D"max-width: 100%;" class=3D"">The denylist contains svg, = javascript, and html, which have known cross site scripting = possibilities.</p></li><li style=3D"max-width: 100%;" class=3D""><p = style=3D"max-width: 100%;" class=3D"">By popular request, allow showing = PDF files inline.<br style=3D"max-width: 100%;" class=3D"">Note: browser = preference plays a part in what actually happens.</p></li><li = style=3D"max-width: 100%;" class=3D""><p style=3D"max-width: 100%;" = class=3D"">In untrusted path expressions with modules, check that each = module is allowed.<br style=3D"max-width: 100%;" class=3D"">In the first = version of the hotfix we disallowed modules that were available as a = 'private' alias, for example <code style=3D"max-width: 100%;" = class=3D"">random._itertools</code>.<br style=3D"max-width: 100%;" = class=3D"">But if <code style=3D"max-width: 100%;" = class=3D"">random.itertools</code> without underscore would have = been available, it was still allowed, even though <code = style=3D"max-width: 100%;" class=3D"">itertools</code> has not been = explicitly allowed.<br style=3D"max-width: 100%;" class=3D"">(<code = style=3D"max-width: 100%;" class=3D"">itertools</code> might be = fine to allow, it is just an example.)<br style=3D"max-width: 100%;" = class=3D"">This version is a recommended upgrade for all = users.</p></li></ul></div></div></blockquote><blockquote type=3D"cite" = style=3D"border-left-style: none; padding: inherit; margin: inherit;" = class=3D""><div class=3D""><div role=3D"article" style=3D"text-rendering: = optimizeLegibility; font-family: -apple-system-font; font-size: 1.2em; = line-height: 1.5em; margin: 0px; padding: 0px;" class=3D"system = exported" id=3D"article"><div class=3D"page" style=3D"word-wrap: = break-word; max-width: 100%;"><p style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D""><strong style=3D"max-width: = 100%;" class=3D"">CVE numbers:</strong> CVE numbers have been = assigned; see the individual pages.</font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D""><strong = style=3D"max-width: 100%;" class=3D""></strong><strong style=3D"max-width:= 100%;" class=3D"">Versions Affected:</strong> All supported Plone = versions (4.3.20 and any earlier 4.3.x version, 5.2.4 and any earlier = 5.x version).</font></p><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D""><strong style=3D"max-width: 100%;" = class=3D"">Versions Not Affected:</strong> None.</font></p><p = style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">Nature of = vulnerabilities:</font></strong></p><p style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">The patch will = address several security issues:</font></p> <ul style=3D"max-width: 100%;" class=3D""> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Remote Code Execution via traversal in = expressions. Reported by David Miller.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Writing arbitrary files via docutils and Python Script. = Reported by Calum Hutton.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Various information disclosures: mostly installation = logs. Reported by Calum Hutton.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Stored XSS from file upload (svg, html). Reported = separately by Emir C=C3=BCneyt Akkutlu and Tino Kautschke.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Reflected XSS in various spots. Reported by Calum = Hutton.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">XSS vulnerability in CMFDiffTool. Reported by Igor = Margitich.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Stored XSS from user fullname. Reported by Tino = Kautschke.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Blind SSRF via feedparser accessing an internal = URL. Reported by Subodh Kumar Shree.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Server Side Request Forgery via event ical URL. Reported = by MisakiKata and David Miller.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Server Side Request Forgery via lxml parser. Reported by = MisakiKata and David Miller.</font></li> </ul><p style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Thank you to all who contacted the <a = href=3D"mailto:security-z4DKO/[email protected]" style=3D"max-width: 100%;" = class=3D"">Plone security team</a> to report problems!</font></p><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D""><strong style=3D"max-width: 100%;" class=3D"">Version = support: </strong>The hotfix is officially supported by the Plone = security team on the following versions of Plone in accordance with = the <a href=3D"https://plone.org/security/update-policy" = style=3D"max-width: 100%;" class=3D"">Plone version support = policy</a>: 4.3.20, 5.0.10, 5.1.7, 5.2.4. Previous versions, like 4.2, = could be affected but have not been tested. On such old versions, the = hotfix might have worse side effects than what it tries to = fix.</font></p><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">The fixes included here will be = incorporated into subsequent releases of Plone, so Plone 5.2.5 and = greater should not require this hotfix. </font></p><p class=3D"clear"= style=3D"max-width: 100%; clear: both;"><font color=3D"#000000" = class=3D""><strong style=3D"max-width: 100%;" class=3D"">Warning</strong>:= The hotfix has <strong style=3D"max-width: 100%;" = class=3D"">not</strong> been tested with Python 2.6. Originally = Plone 4.3 was supported on Python 2.6, but since a few releases this is = no longer the case since. It gets ever more difficult to test on Python = 2.6. By now, you may have trouble installing <em style=3D"max-width: = 100%;" class=3D"">any</em> package with Python 2.6.</font></p><p = style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">The patch was released = at <a target=3D"_blank" = href=3D"http://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=3D2021&a= mp;mo=3D05&d=3D18&h=3D15&mn=3D0" rel=3D"noopener" = style=3D"max-width: 100%;" class=3D"">2021-05-18 15:00 = UTC</a>.</font></strong></p> <h2 style=3D"font-size: 1.43em; max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Installation</font></h2><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Full installation instructions are available on <a = href=3D"https://plone.org/security/hotfix/20210518" style=3D"max-width: = 100%;" class=3D"">the HotFix release page</a>.</font></p> <h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Standard security advice</font></h3> <ul style=3D"max-width: 100%;" class=3D""> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Make sure that the Zope/Plone service is running with minimum = privileges. Ideally, the Zope and ZEO services should be able to write = only to log and data directories. Plone sites installed through our = installers already do this.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Use an intrusion detection system that monitors key system = resources for unauthorized changes.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Monitor your Zope, reverse-proxy request and system logs for = unusual activity.</font></li> <li style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Make sure your administrator stays up to date, by following = the special low-volume <a title=3D"" = href=3D"https://lists.sourceforge.net/lists/listinfo/plone-announce" = target=3D"_self" style=3D"max-width: 100%;" class=3D"">Plone Security = Announcements list via email</a>, <a = href=3D"https://plone.org/security/announcements/RSS" style=3D"max-width: = 100%;" class=3D"">RSS </a>and/or <a title=3D"" = href=3D"https://twitter.com/plone" target=3D"_self" style=3D"max-width: = 100%;" class=3D"">Twitter</a></font></li> </ul><p style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">These are standard precautions that should be employed on any = production system, and are not tied to this fix.</font></p> <h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Extra Help</font></h3><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D"">If you do not have = in-house server administrators or a service agreement for supporting = your website, you can find consulting companies at <a = href=3D"http://plone.com/providers" style=3D"max-width: 100%;" = class=3D"">plone.com/providers</a></font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D"">There is = also <a href=3D"https://plone.org/support" style=3D"max-width: = 100%;" class=3D"">free support </a>available online via the <a = href=3D"https://community.plone.org/" style=3D"max-width: 100%;" = class=3D"">Plone forum</a> and the <a = href=3D"https://plone.org/support/chat" style=3D"max-width: 100%;" = class=3D"">Plone chat channels</a>.</font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D""><strong = style=3D"max-width: 100%;" class=3D"">Q: When will the patch be made = available?<br style=3D"max-width: 100%;" class=3D""></strong>A: The = Plone Security Team released the patch at <strong style=3D"max-width:= 100%;" class=3D""><a target=3D"_blank" = href=3D"http://www.worldtimeserver.com/convert_time_in_UTC.aspx?y=3D2021&a= mp;mo=3D05&d=3D18&h=3D15&mn=3D0" rel=3D"noopener" = style=3D"max-width: 100%;" class=3D"">2021-05-18 15:00 = UTC</a>.</strong></font></p><p style=3D"max-width: 100%;" class=3D""><font= color=3D"#000000" class=3D""><strong style=3D"max-width: 100%;" = class=3D"">Q. What will be involved in applying the patch?<br = style=3D"max-width: 100%;" class=3D""></strong>A. Patches are made = available as tarball-style archives that may be unpacked into the <kbd = style=3D"max-width: 100%;" class=3D"">products</kbd> folder of a = buildout installation (for Plone 5.1.x and earlier only) and as Python = packages that may be installed by editing a buildout configuration file = and running buildout. Patching is generally easy and quick to = accomplish.</font></p><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D""><strong style=3D"max-width: 100%;" = class=3D"">Q: How were these vulnerabilities found?<br style=3D"max-width:= 100%;" class=3D""></strong>A: The vulnerabilities were found by users = submitting them to the security mailing list.</font></p><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D""><strong style=3D"max-width: 100%;" class=3D"">Q: My site is = highly visible and mission-critical. I hear the patch has already been = developed. Can I get the fix before the release date?</strong><br = style=3D"max-width: 100%;" class=3D"">A: No. The patch will be made = available to <strong style=3D"max-width: 100%;" class=3D"">all = administrators at the same time</strong>. There are no = exceptions.</font></p><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D""><strong style=3D"max-width: 100%;" = class=3D"">Q: If the patch has been developed already, why isn't it made = available to the public now?<br style=3D"max-width: 100%;" = class=3D""></strong> A: The Security Team is still testing the patch = against a wide variety of configurations and running various scenarios = thoroughly. The team is also making sure everybody has appropriate time = to plan to patch their Plone installation(s). Some consultancy = organizations have hundreds of sites to patch and need the extra time to = coordinate their efforts with their clients.</font></p><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D""><strong style=3D"max-width: 100%;" class=3D"">Q: How does one = exploit the vulnerability?<br style=3D"max-width: 100%;" = class=3D""></strong>A: This information will not be made public until = after the patch is made available.</font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D""><strong = style=3D"max-width: 100%;" class=3D"">Q: Is my Plone site at risk for = this vulnerability?</strong><strong style=3D"max-width: 100%;" = class=3D""> How do I know if my site has been = exploited?</strong><strong style=3D"max-width: 100%;" class=3D""> How= can I confirm that the hotfix is installed correctly and my site is = protected?</strong></font></p><p style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">A: Details about the = vulnerability will be revealed at the same time as the = patch.</font></p><p style=3D"max-width: 100%;" class=3D""><strong = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Q: How can I report other potential security = vulnerabilities?</font></strong></p><p style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">A: Please email the Plone = Security Team at <a href=3D"mailto:security-z4DKO/[email protected]" = style=3D"max-width: 100%;" class=3D"">security-z4DKO/[email protected]</a> rather = than publicly discussing potential security issues.</font></p><p = style=3D"max-width: 100%;" class=3D""><strong style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">Q: How can I apply the = patch without affecting my users?</font></strong></p><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">A: Even though this patch does NOT require you to run = buildout, you can run buildout without affecting your users. You can = restart a multi-client Plone install without affecting your users; = see <a href=3D"http://docs.plone.org/manage/deploying/processes.html"= style=3D"max-width: 100%;" = class=3D"">http://docs.plone.org/manage/deploying/processes.html</a> = </font></p><p style=3D"max-width: 100%;" class=3D""><strong = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">Q: How do I get help patching my site?</font></strong></p><p = style=3D"max-width: 100%;" class=3D""><font color=3D"#000000" = class=3D"">A: Plone service providers are listed at <a = href=3D"http://plone.com/providers" style=3D"max-width: 100%;" = class=3D"">plone.com/providers </a> There is also <a = href=3D"https://plone.org/support" style=3D"max-width: 100%;" = class=3D"">free support </a>available online via the <a = href=3D"https://community.plone.org/" style=3D"max-width: 100%;" = class=3D"">Plone forum</a> and the <a = href=3D"https://plone.org/support/chat" style=3D"max-width: 100%;" = class=3D"">Plone chat channels</a></font></p><p style=3D"max-width: = 100%;" class=3D""><strong style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Q: Who is on the Plone Security Team and = how is it funded?</font></strong></p><p style=3D"max-width: 100%;" = class=3D""><font color=3D"#000000" class=3D"">A: The <a = href=3D"https://plone.org/community/security/security" style=3D"max-width:= 100%;" class=3D"">Plone Security Team</a> is made up of volunteers who = are experienced developers familiar with the Plone code base and with = security exploits. The Plone Security Team is not funded; members and/or = their employers have volunteered their time in the interests of the = greater Plone community.</font></p><p style=3D"max-width: 100%;" = class=3D""><strong style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Q: How can I help the Plone Security = Team?</font></strong></p><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">A: The Plone Security Team is looking for = help from security-minded developers and testers. Volunteers must = be known to the Security Team and have been part of the Plone community = for some time. To help the Security Team financially, your donations are = most welcome at <a target=3D"_blank" href=3D"https://plone.org/sponsors" = rel=3D"noopener" style=3D"max-width: 100%;" = class=3D"">http://plone.org/sponsors</a></font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D""><strong = style=3D"max-width: 100%;" class=3D"">General questions about this = announcement</strong>, Plone patching procedures, and availability of = support may be addressed to the <a href=3D"https://plone.org/support"= style=3D"max-width: 100%;" class=3D"">Plone support forums</a> If = you have specific questions about this vulnerability or its = handling, contact the Plone Security Team at <a = href=3D"mailto:security-z4DKO/[email protected]" style=3D"max-width: 100%;" = class=3D"">security-z4DKO/[email protected]</a></font></p><p style=3D"max-width: = 100%;" class=3D""><font color=3D"#000000" class=3D""><strong = style=3D"max-width: 100%;" class=3D"">To report potentially = security-related issues</strong>, email the Plone Security Team = at <a href=3D"mailto:security-z4DKO/[email protected]" style=3D"max-width: 100%;" = class=3D"">security-z4DKO/[email protected]</a> We are always happy to credit = individuals and companies who make responsible disclosures.</font></p> <h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">Information for Vulnerability Database = Maintainers</font></h3><p style=3D"max-width: 100%;" class=3D""><font = color=3D"#000000" class=3D"">We will apply for CVE numbers for these = issues. Further information on individual vulnerabilities (including = CVSS scores, CWE identifiers and summaries) will be available at <a = href=3D"https://plone.org/hotfixes" style=3D"max-width: 100%;" = class=3D"">the full vulnerability = list.</a></font></p></div></div></div></blockquote></div></div></body></ht= ml>= --Apple-Mail=_EE282C6E-451A-46EE-AA44-5BEB23976816-- --===============2088130246138229008== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2088130246138229008== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Plone-Announce mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/plone-announce --===============2088130246138229008==--