Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 13 Feb 2013 03:02:05 -0700
From: Kurt Seifried <>
CC: Jan Lieskovsky <>,
        "Steven M. Christey" <>,
        Michel Alexandre Salim <>,
        Richard Jones <>,
        Ralf Schlatterbeck <>
Subject: Re: CVE Request -- roundup: Multiple XSS flaws plus
 other security related fixes corrected in upstream 1.4.20 version

Hash: SHA1

On 11/10/2012 04:42 AM, Jan Lieskovsky wrote:
> Hello Kurt, Steve, vendors,

Ok some questions/comments inline

> Roundup upstream has released new upstream 1.4.20 version, 
> correcting multiple cross-site scripting (XSS) flaws (and couple of
> other security related issues): [1]
> [2]
> More from [1] (plus relevant tickets inlined too, where possible to
> find out): 
> --------------------------------------------------------- [A] *
> issue2550729: Fix password history display for anydbm backend, 
> thanks to Ralf Hemmecke for reporting. (Ralf) [3]

[A] Doesn't have security implications if roundup is correnctly
configured. The bug would create a python backtrace. Unless the "debug"
option in section [web] is set (which is explicitly discouraged) this
will only display "an error has occurred" in the web-interface. Even if
someone sets the debug option in a production release only the hashed
password could be disclosed. Note that this bug only affects the anydbm
backend which should not be used for a production version either.

> [B] * issue2550684 Fix XSS vulnerability when username contains
> HTML code, thanks to Thomas Arendsen Hein for reporting and patch.
> (Ralf) [4]

Please use CVE-2012-6130 for this issue

> [C] * issue2550711 Fix XSS vulnerability in @action parameter, 
> thanks to "om" for reporting. (Ralf) [5]

Please use CVE-2012-6131 for this issue

> [D] * Fix wrong execute permissions on some files, thanks to Cheer
> Xiao for the patch. (Ralf)

[D] No security implications: Fixed some permissions on files in
roundup/cgi and locale directories. These are not accessible via the
web-server. So this doesn't constitute a remote vulnerability. Local
users don't gain anything executing these files as no privilege
escalation is involved (they could copy the file which is readable
anyway and make their local copy executable).

> [E] * Fix another XSS with the "otk" parameter, thanks to Jesse
> Ruderman for reporting. (Ralf)

Please use CVE-2012-6132 for this issue

> [F] * Mark cookies HttpOnly and -- if https is used -- secure.
> Fixes issue2550689, but is untested if this really works in
> browsers. Thanks to Joseph Myers for reporting. (Ralf) [6]

This appears to be security hardening, not a vulnerability, is that

> [G] * Fix another XSS with the ok- and error message, see
> issue2550724. We solve this differently from the proposals in the
> bug-report by not allowing any html-tags in ok/error messages 
> anymore. Thanks to David Benjamin for the bug-report and to Ezio
> Melotti for several proposed fixes. (Ralf) [7]

Please use CVE-2012-6133 for this issue

> Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues [A]
> and [D] would also have security implications / IOW if those would
> be security flaws too. Ralf please clarify. Thank you, Jan.
> Could you allocate CVE ids for these (once clarified)?
> Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat
> Security Response Team

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.