mailing list archives
Re: Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 14 Nov 2012 10:26:16 -0700
-----BEGIN PGP SIGNED MESSAGE-----
On 11/10/2012 05:28 AM, Ralf Schlatterbeck wrote:
On Sat, Nov 10, 2012 at 06:54:46AM -0500, Jan Lieskovsky wrote:
[A] * issue2550729: Fix password history display for anydbm
backend, thanks to Ralf Hemmecke for reporting. (Ralf) 
[D] * Fix wrong execute permissions on some files, thanks to
Cheer Xiao for the patch. (Ralf)
Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues
[A] and [D] would also have security implications / IOW if those
would be security flaws too. Ralf please clarify. Thank you,
[A] Doesn't have security implications if roundup is correnctly
configured. The bug would create a python backtrace. Unless the
"debug" option in section [web] is set (which is explicitly
discouraged) this will only display "an error has occurred" in the
web-interface. Even if someone sets the debug option in a
production release only the hashed password could be disclosed.
Note that this bug only affects the anydbm backend which should not
be used for a production version either.
How is the password hashed?
[D] No security implications: Fixed some permissions on files in
roundup/cgi and locale directories. These are not accessible via
the web-server. So this doesn't constitute a remote vulnerability.
Local users don't gain anything executing these files as no
privilege escalation is involved (they could copy the file which is
readable anyway and make their local copy executable).
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
-----END PGP SIGNATURE-----