CVE-2023-42458

Advisory

Plone.restapi 8.43.3 includes a fix for CVE-2023-42458: Stored Cross Site Scripting with SVG image in user portrait.
https://github.com/plone/plone.restapi/security/advisories/GHSA-hc5c-r8m5-2gfh

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

Breaking changes:


- Remove deprecated unlock, refresh-lock endpoints avoinea (1235)
- Remove `plone.tiles` and the `tiles` endpoint. tisto (1308)
- Change the linkintegrity endpoint to add `items_total`, the number of contained items which would be deleted. davisagli, danalvrz, pgrunewald (1636)
- The default branch was renamed from `master` to `main`. tisto, davisagli (1695)
- Drop support for Python 3.7. Set python_requires to >= 3.8 tisto (1709)


New features:


- Add Spanish translation macagua (1684)
- Add support for getting the `/querystring` endpoint in a specific context. davisagli (1704)


Bug fixes:


- Fix stored XSS (Cross Site Scripting) for SVG image in user portrait.
Done by forcing a download instead of displaying inline.
Normal accessing via an image tag is not affected and is safe.
See `security advisory <https://github.com/plone/plone.restapi/security/advisories/GHSA-hc5c-r8m5-2gfh>`_. maurits (#1)
- Use incoming request to produce location for `tus-upload`. instification (1570)
- Undeprecate comma separated expansion parameters (that were deprecated in plone.restapi 8) tisto (1696)
- Undeprecate token parameter from vocabularies endpoint tisto (1697)
- Improve RESOLVEUID_RE regexp to catch also paths generated by Link content-types. cekk (1699)


Internal:


- Upgrade buildout: Plone 6.0.6 -> 6.0.7 and Plone 5.2.12 -> 5.2.14 tisto (1706)


Documentation:


- Added translation code through expansion. Akshat2Jain (1374)
- Restores formatting and fixes some MyST syntax from 1689. stevepiercy (1691)
- Documentation fixes for 1599. stevepiercy (1692)
- Fix linkcheckbroken 301 redirect to https://www.4teamwork.ch/en. stevepiercy (#1693)
- Polish docs for v9 release. stevepiercy (1698)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42458
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v
• https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb
• https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088
• http://www.openwall.com/lists/oss-security/2023/09/22/2