Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: mantis before 1.2.12
From: Kurt Seiifried <kseifried () redhat com>
Date: Wed, 14 Nov 2012 00:18:20 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/13/2012 11:26 AM, Kurt Seiifried wrote:
On 11/13/2012 07:52 AM, Hanno Böck wrote:
http://www.mantisbt.org/bugs/changelog_page.php?version_id=150

New mantis bugtracker release. Two fixes are security relevant 
(althouhg both sound minor)

Just to confirm I understand these issues:

- 0014496: [security] Workflow Transitions: Minimal Access Level 
to Change to this status has no correct 'default' (dregad) - 
resolved. http://www.mantisbt.org/bugs/view.php?id=14496

This is an information disclosure: "Consequently, saving the page 
without changes would cause the config to be saved with all access 
levels as 'viewer'."

Please use CVE-2012-5522 for this issue.

- 0014704: [security] Clone and Move issue with Copy bug notes - 
user get email notice from project without access (dregad) - 
closed. http://www.mantisbt.org/bugs/view.php?id=14704

Also an information disclosure: Now any action on IssueB eg. add 
notes, change status causes send email notice to UserA from
IssueB. UserA don't have access to IssueB by can read whole history
and any notes from email body.

Please use CVE-2012-5523 for this issue.

Please assign CVEs.


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQo0W8AAoJEBYNRVNeJnmTdo8P/1/xNKJVKTk4tQDOy0rkquxW
oyxuCZT4jioFksYzX5buyqofInlBNNZIz95e8ksg2ppX/KflIv+pz+rkPZGrn99T
miUGId9RKKIBwxI6IPqBLx0D1gC9iZDfEL1j47c/mCoJRgdIKCB+wd1ocG5dTcSD
IuC5DmRF2lfdfKIaodGDOBZGNSKLev9HR8tzeSduAOZ1qzKFZYp9VuwDz0obtYvY
MR5wHYn5cBcSJH7ZtJ7sY2C4Ks1jAqm8fEcY+5GV03OVAlTAN46k6YAX94aIFShX
LQl15PI1xzrAKKs4QEWPmdIlv4aDzaKt3jr1bG5exIR7khnMSR0zxwvu1+AvrZml
VgAUbYcExeHjtod3OzadKqKrHDvfOJJM74N5G3LD1zqA/epGF2O4Mz5SSs8buFkr
K538HQ+gmPy4NfrJvKHE2zFrZIPF9CsNpPR/pj2WHyIWiej0b+R8p4TzaYv3Kqa3
xvu9WI6heUK1RJ1ulSeSgE4HV7CEQEyzky8ztMthoAyYIuTzHkcAIcT5I4UsNXpE
HpBTrMKzZUaBGVzor0pm8w/gwMmbwHtetR6IBpnPMnqxO/1frK0vyurh/E4kyXii
dAdpNRWRJcxq3m846F1HjfMfEqmid0lAbMiA/MRK+hzEUIttekBPfpgR1UU3RoIy
jllL9pXbpUujAWyFoLW+
=kIyP
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]