Security notification: XSS and sandbox escape vulnerability in Plone

The Plone project has released a new patch that fixes a XSS and a sandbox escape vulnerability in the application.

You can find more info about these issues on the Plone Security Announcements page.

All supported Plone versions (4.3.11 and any earlier 4.x version, 5.0.6 and any earlier 5.x version) are affected. Previous versions could be affected but have not been fully tested. We highly recommend patching your existing Plone sites by following the steps below:

1. Create a backup of your current installation of the application

https://docs.bitnami.com/?page=apps&name=plone&section=how-to-create-a-full-backup-of-plone

2. Download the available patch at the security page

https://plone.org/security/hotfix/20170117

3. Unpack the zip file at /opt/bitnami/apps/plone/zeocluster/products

4. Modify the permissions of the files

    sudo chown -R plone:plone /opt/bitnami/apps/plone/zeocluster/products

5. Restart the Plone service

    sudo /opt/bitnami/ctlscript.sh restart plone

6. Check that the application has been restarted properly. You should see these lines in the /opt/bitnami/apps/plone/zeoclustervar/client1/event.log file

------
2017-02-27T11:04:58 INFO Products.PloneHotfix20170117 Applied zmi patch
------
2017-02-27T11:04:58 INFO Products.PloneHotfix20170117 Applied strformat patch
------
2017-02-27T11:04:58 INFO Products.PloneHotfix20170117 Hotfix installed

Do you have additional questions about Bitnami Plone or the security vulnerability? Please post to our community forum and we will be happy to help you.

New BitNami Stack for Plone!

We are happy to announce a new addition to the BitNami Application Library, Plone CMS. It is a free and open source content management system built with Python on top of the Zope application server. Plone can be used for all types of websites, including blogs, internet sites, webshops and internal websites.

The BitNami Plone Stack simplifies the installation and configuration process of Plone and its dependencies. It includes a pre-configured version of Plone 2.4.1, Python 2.7, Apache 2.2 and all other required dependencies.

The BitNami Plone Stack is configured for both development and production environments. The default configuration is the following:

• Apache is configured as a proxy server. It is running in the default port (80 or 8080) and you can also configure it for serving your static content in production.
• Zope is running as a one instance cluster. You can easily add more instances to the cluster in your production environment. It is running in port 8081 by default.
• Zeo server is running in port 8100 by default.

Once you have downloaded and installed the free native installer, virtual machine or deployed the Amazon Machine Images (AMI's) in the cloud, you can access the Zope management interface and create your first Plone site.

Zope management interface

New Plone site

Check our Quick Start Guide to learn more about how to start working with your BitNami Plone deployment. 

We also provide simplified deployment and management of Plone in the cloud with BitNami Cloud Hosting. Sign up for our free developer plan to check it out!