[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5c47d85c-2648-d0ed-714f-f4e0b2e497ed@vanrees.org>
Date: Tue, 21 Jan 2020 23:49:31 +0100
From: Maurits van Rees <maurits@...rees.org>
To: oss-security@...ts.openwall.com
Subject: Plone security hotfix 20200121
A Plone security hotfix was released today.
CVE numbers: not yet issued. We will request them shortly from mitre.org.
Versions Affected: All supported Plone versions (4.3.15 and any earlier
4.x version, 5.2.1 and any earlier 5.x version). Previous versions could
be affected but have not been tested.
Versions Not Affected: None.
Nature of vulnerability:
The patch addresses several security issues:
- Privilege escalation when plone.restapi is installed. Reported and
fixed by Lukas Graf and Niklaus Johner.
- An open redirection on the login form and possibly other places where
redirects are done.
- The isURLInPortal check that is done to avoid linking to an external
site could be tricked into accepting malicious links. Reported by
Damiano Esposito.
- Password strength checks were not always checked. Reported by Ben Kummer.
- You might be able to PUT (overwrite) some content without needing
write permission.
This seems hard to do in practice. This fix is only needed when you
use plone.app.contenttypes. Reported and fixed by Alessandro Pisa.
- SQL quoting in DTML or in connection objects was insufficient, leading
to possible SQL injections. This is a problem in Zope. If you use Zope
without Plone, this hotfix should work for you too. Reported and fixed
by Michael Brunnbauer and Michael Howitz.
- Cross Site Scripting (XSS) in the title field on plone 5.0 and higher.
Reported by Marcos Valle.
Version support: The hotfix is officially supported by the Plone
security team on the following versions of Plone in accordance with the
Plone version support policy: 4.3.19, and 5.0.10, 5.1.6, 5.2.1. It was
also tested on Plone 4.2.7. It is recommended also for Plone 4.0 and
4.1, but this has not been tested.
The fixes included here will be incorporated into subsequent releases of
Plone, so Plone 4.3.20, 5.1.7, 5.2.2 and greater should not require this
hotfix.
The above is a copy from the release notes.
Full details: https://plone.org/security/hotfix/20200121
--
Maurits van Rees https://maurits.vanrees.org/
Member of Plone Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
