CVE-2021-33511

Advisory

Plone.app.theming 5.0.0a1 and 4.1.6 include a fix for CVE-2021-33511: Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser

Affected package

Affected versions

Fixed versions

Vulnerability changelog

--------------------

Breaking changes:


- Add bootstrap icon from resolver from Plone 6.
[petschki, agitator] (194)


Bug fixes:


- Avoid Server Side Request Forgery via lxml parser.
Taken over from `PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser>`_.
[maurits] (3274)

Resources

• https://pypi.org/project/plone-app-theming
• https://pyup.io/changelogs/plone-app-theming/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33511
• https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser
• http://www.openwall.com/lists/oss-security/2021/05/22/1