up vote 1 down vote favorite
share [g+] share [fb]

We're running Plone 4.1rc3 with Python 2.6.6 on Linux. I noticed that there is a new release of Python, 2.6.7, that contains some security patches. The Plone instance is using a dedicated Python installation on the server: the Python installation was built by the same user that owns the Plone installation and no other processes use it.

First question is I guess whether upgrading is necessary or not? If it is a good idea to upgrade then what steps should I follow? I know how to download and build Python.

link|improve this question
I'm confused by this question.. do you mean you are writing code in python, and manage it with Plone or...? Forgive my ignorance. – DKGasser Jun 30 '11 at 18:32
I almost voted to close this as I thought you said "phone" and not "plone". – KronoS Jun 30 '11 at 22:32
feedback

migrated from stackoverflow.com Jun 30 '11 at 22:22

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 3 down vote accepted

I am also curious about this.

I guess to find out if plone is vulnerable would require going through the code and seeing if any of the security issues pertain to modules plone uses:

http://blog.python.org/2011/04/urllib-security-vulnerability-fixed.html -- Affects FancyURLopener and HTTPRedirectHandler

  • FancyURLopener - not found in use anywhere
  • HTTPRedirectHandler - USED by feedparser and uses the affected method which plone depends on(at least the version I'm looking at). feedparser is used by plone in it's RSS feed portlet.

http://bugs.python.org/issue9129 -- affects SMTPServer

  • SMTPServer - not used anywhere

http://bugs.python.org/issue11442 -- affects SimpleHTTPServer

  • SimpleHTTPServer -- is referenced in the documentation; though, it states how it DOES NOT use SimpleHTTPServer

Unless I missed any security vulnerabilities python 2.6.7 affects, it seems like plone is only affected by one of those vulnerabilities.

Plone will probably not do special releases for unified installer dependencies and will just incrementally incorporate new versions of python.

Is it necessary to upgrade? You determine if it is necessary or not. If you have users using the rss feed portlet, I'd upgrade. However, if you do not have users using it, you could perhaps even disable the portlet in the meantime...

How do I upgrade? Install the new version, run something like this where you have buildout:

/path/to/python bootstrap.py
./bin/buildout

and restart the clients and zeoserver.

link|improve this answer
OK simple enough. I've upgraded our test server with no issues. Thanks for your help vangheem – scarba05 Jul 1 '11 at 9:04
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.