Date: Fri, 23 Oct 2015 15:19:11 +0200 From: Patrick Uiterwijk <puiterwijk@...hat.com> To: oss-security@...ts.openwall.com Subject: [CVE-2015-5215] Ipsilon: XSS in multiple pages CVE-2015-5215: Ipsilon XSS in multiple pages Versions affected: 0.1.0 to 1.0.0 Fixed in versions: 1.0.1, 1.1.0 Description: It was found that the Ipsilon IdP server used the default configuration of the Jinja templating engine, which did not HTML escape template variables. This could be exploited to perform an XSS attack if a value from untrusted input was used in the template and rendered in the user`s browser. Mitigation: Users of Ipsilon should update to version 1.0.1 or later. Credit: This issue was discovered by Michael Scherer of Red Hat. References: https://bugzilla.redhat.com/show_bug.cgi?id=1255168 -- Patrick Uiterwijk Fedora Infrastructure Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.