I am also curious about this.
I guess to find out if plone is vulnerable would require going through the code and seeing if any of the security issues pertain to modules plone uses:
http://blog.python.org/2011/04/urllib-security-vulnerability-fixed.html -- Affects FancyURLopener and HTTPRedirectHandler
- FancyURLopener - not found in use anywhere
- HTTPRedirectHandler - USED by feedparser and uses the affected method which plone depends on(at least the version I'm looking at). feedparser is used by plone in it's RSS feed portlet.
http://bugs.python.org/issue9129 -- affects SMTPServer
- SMTPServer - not used anywhere
http://bugs.python.org/issue11442 -- affects SimpleHTTPServer
- SimpleHTTPServer -- is referenced in the documentation; though, it states how it DOES NOT use SimpleHTTPServer
Unless I missed any security vulnerabilities python 2.6.7 affects, it seems like plone is only affected by one of those vulnerabilities.
Plone will probably not do special releases for unified installer dependencies and will just incrementally incorporate new versions of python.
Is it necessary to upgrade? You determine if it is necessary or not. If you have users using the rss feed portlet, I'd upgrade. However, if you do not have users using it, you could perhaps even disable the portlet in the meantime...
How do I upgrade? Install the new version, run something like this where you have buildout:
and restart the clients and zeoserver.