CVE-2021-33510

Advisory

Plone.app.event 4.0.0a4 includes a fix for a server-side-request-forgery vulnerability. Now, "file:" protocol is not allowed in iCal url. Previously, only "file://" was disallowed, but this left room for relative paths.
https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url
https://github.com/plone/plone.app.event/commit/70bf81822240d2808e6e9d3538586f78f4cd91bf

Affected package

Affected versions

Fixed versions

Vulnerability changelog

--------------------

Bug fixes:


- Do not allow ``file:`` protocol in ical url.
Previously, only ``file://`` was disallowed, but this left room for relative paths.
Taken over from `PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url>`_.
[maurits] (3274)

Resources

• https://pypi.org/project/plone.app.event
• https://pyup.io/changelogs/plone.app.event/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33510
• https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url
• http://www.openwall.com/lists/oss-security/2021/05/22/1