Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
19.0.0-alpha.617.22.218.27.216.34.1· Vendor fix available
Issue
Impact When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error. Patches The problem has been patched and the patch has been backported to Volto major versions down until 16. It is advised to upgrade to the latest patch release of your respective current major version: - Volto 16: 16.34.1 - Volto 17: 17.22.2 - Volto 18: 18.27.2 - Volto 19: 19.0.0-alpha6 Workarounds Make sure your setup automatically restarts processes that quit with an error. This won't prevent a crash, but it minimises downtime. Report The problem was discovered by FHNW, a client of Plone provider kitconcept, who shared it with the Plone Zope Security Team (security@plone.org).
Recommended action: Upgrade to 19.0.0-alpha.6 (pre-release), 18.27.2, 17.22.2 or 16.34.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
18.24.016.34.017.22.119.0.0-alpha.4· Vendor fix available
Issue
Impact When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error. Patches The problem has been patched and the patch has been backported to Volto major versions down until 16. It is advised to upgrade to the latest patch release of your respective current major version: - Volto 16: 16.34.0 - Volto 17: 17.22.1 - Volto 18: 18.24.0 - Volto 19: 19.0.0-alpha4 Workarounds Make sure your setup automatically restarts processes that quit with an error. This won't prevent a crash, but it minimises downtime. Report The problem was discovered by FHNW, a client of Plone provider kitconcept, who shared it with the Plone Zope Security Team (security@plone.org).
Recommended action: Upgrade to 19.0.0-alpha.4 (pre-release), 18.24.0, 17.22.1 or 16.34.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges. A proven exploit for this vulnerability does not exist, since the exact requisites for it to happen have not been fully clarified, and the attempts to reproduce it under testing conditions have been unsuccessful, but it still can happen randomly and unintentionally in the wild. Patches The patch and fix is present in Volto 15.0.0-alpha.0 (or later). See PR: https://github.com/plone/volto/pull/3051. We recommend upgrading to the final release of Volto 15 as soon as possible if running an affected version. See the upgrade guide https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x Workarounds It is possible to create a fix by manually upgrading…
Recommended action: Upgrade to 15.0.0-alpha.0 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.