Plone security fixes 20260623

Announcements Security
1

On behalf of the Plone/Zope Security Team I announce several vulnerability fixes.

Two others were already made public recently, we list them here for good measure: icalendar and RestrictedPython.

Some are only a vulnerability on Classic UI (for example, Volto has no portlets), but others are a vulnerability on Volto as well.

All these combined, you should update your Plone sites to the following versions (formatted as pip constraints here):

Plone 6.2:

icalendar==7.1.3
plone.app.contenttypes==5.0.1
plone.app.dexterity==5.0.1
plone.app.event==6.0.1
plone.app.portlets==7.0.2
RestrictedPython==8.3

Plone 6.1:

plone.app.contenttypes==4.0.10
plone.app.dexterity==4.1.3
plone.app.event==5.2.4
plone.app.portlets==6.0.4
RestrictedPython==8.3

Plone 6.0:

plone.app.contenttypes==3.0.12
plone.app.dexterity==3.2.3
plone.app.event==5.2.4
plone.app.portlets==5.0.8
RestrictedPython==8.3; python_version > '3.10'

You may want to check if you have already applied the plone.app.textfield and plone.restapi fixes from the June 5 announcement.

If you think a security issue was incompletely solved, please contact the Plone/Zope Security Team via email at security@plone.org.

If these versions cause other problems, you can comment below, or open an issue in the Products.CMFPlone tracker. Please check if anything was reported already.

6 Likes
Pre-announcement: security fixes Tuesday 23 June
Plone 6.1.5 released
2

is there a 6.2.1 in Index of /release/ with these changes?

1 Like
3

is there a 6.2.1 in Index of /release/ with these changes?

Not yet. Awaiting some last package releases (not security related).

I have just released Plone 6.1.5 with all security fixes.

1 Like
4

https://dist.plone.org/release/6.2.1/ is available now, and includes the security fixes. I will properly announce it later today.

plone-backend Docker images for 6.1.5 and 6.2.1 are not ready yet.

3 Likes
5

@mauritsvanrees cookieplone is failing because it finds a 6.2.1 but there’s no image. What is preventing it to have it?

6

The PR for 6.2.1 is merged now, and release made, so the image should hopefully arrive soon.

Plone-backend for 6.1.5 is not building. I hope 6.2.1 does not have this problem.

7

@mauritsvanrees FYI, unrelated to these updates, but pypa/advisory-database introduced a very old false positive vulnerability report yesterday for plone.app.contenttypes flagging 5.0.1 and 4.0.10 in this PR:

These are obviously incorrect attributions, but they will trip up any Plone 6.1 or 6.2 users also running pip-audit. Maybe someone from the Plone security team can reach out to PYSEC maintainers on this, whatever the official channels for that communication are?

8

plone-backend 6.1.5 and 6.2.1 Docker images are ready now.

1 Like