Date: Tue, 21 Jun 2016 13:00:58 -0500 From: Gregory Haynes <greg@...ghaynes.net> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE Request Openstack-infra puppet-gerrit module xss vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Everyone, A vulnerability was discovered in the OpenStack-Infra Puppet module for Gerrit (see below). In order to ensure full traceability, we need a CVE number assigned. This issue is already public. It was recently discovered that our puppet-gerrit module configures Gerrit in a way which makes it vulnerable to a XSS attack. This stems from our configuration marking text/html as a 'safe' mimetype. This configuration change was first made in May 2014 but we believe it did not begin working until Feb 2015. Using this, a user could potentially craft a review which when visited at the proper url would have access to the account information of any user visiting that url. It is highly recommended that all downstream users of this module apply this commit to protect themselves against this attack. Thanks, Greg 1: https://review.openstack.org/#/c/332219/ 2: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=346618da6d0527335b67d17dea78f7d6c55fb129 3: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=c53838ae2246f74fd5206a1bdb7b8cac656529d9 4: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=8573c2ee172f66c1667de49685c88fdc8883ca8b -- Gregory Haynes greg@...ghaynes.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJXaX7NAAoJELwhhWqbFNDRFp4P/i8eqQYWzV6mbrPZKvYfF2HN KWleeHMIIeMVcDpC2F/3rYIla0A+SMQqrKzPkbYJh10hEbdiEG/mDuYuYkISD/pf Hud9a216bfZdj/naQzyc+0m4bae5Q7viudseX1oFDyHbSTGzEoWcPtakdp+BmYQ7 TsPJm9XsT0F29U0+hQBGOBzzkg5uP+56seou7wZ7WcmuWzLrbWGF8wPJ/XFitqjz N7VN+Ckpd2jsRvlSNCEutS10pBXeH53NB4OWOMcfhOY3Xp2w6sqP3sOopvZZvoBz u468Q2gd7bOmwfKnLKeeuO/JLrN8AJ2wH1vEXPwrVUgXj15Sf34j36XIpcLfTAVK UH3FQ/xq57sdh79Ixa3E6uhlYOtLV9jF6+1Vt9eMApue6ERuv6phmXI6Ni1BM+hW 5pFXJJN/r/rAyTaY8cZLNV56OSPIRE95sJ2bWJ535W/4Unqt+pbTK4FRPBdBJNf3 IKPeh+Uxt7f3HbUwSWA72/1qOWH5yWQs6tanovg2CGwmoTzpRwz5ho+ARjjUljHq tFfiVrsytW9bF16ffXVpUUnAAIqCWm/ZnTXlS96Xuqdj9pW0jTuW9EA8fzsYMQcL nCf8gxHTPGW87P0v9Sf3IxmKp95X3QEdy+WdoH/F/UWTEp4uqICuiMVxwawv3AFL G+xXItIFLYST0JUA0EiQ =mBX/ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ