oss-security - CVE Request Openstack-infra puppet-gerrit module xss vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 21 Jun 2016 13:00:58 -0500
From: Gregory Haynes <greg@...ghaynes.net>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE Request Openstack-infra puppet-gerrit module xss vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Everyone,

A vulnerability was discovered in the OpenStack-Infra Puppet module
for Gerrit (see below). In order to ensure full traceability, we need
a CVE number assigned. This issue is already public.

It was recently discovered that our puppet-gerrit module configures
Gerrit in a way which makes it vulnerable to a XSS attack. This stems
from our configuration marking text/html as a 'safe' mimetype[1].
This configuration change was first made in May 2014[2] but we believe
it did not begin working until Feb 2015[3]. Using this, a user could
potentially craft a review which when visited at the proper url would
have access to the account information of any user visiting that url.

It is highly recommended that all downstream users of this module
apply this commit[4] to protect themselves against this attack.

Thanks,
Greg

1:
https://review.openstack.org/#/c/332219/

2:
http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=346618da6d0527335b67d17dea78f7d6c55fb129

3:
http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=c53838ae2246f74fd5206a1bdb7b8cac656529d9

4:
http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=8573c2ee172f66c1667de49685c88fdc8883ca8b

  -- 
  Gregory Haynes
  greg@...ghaynes.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJXaX7NAAoJELwhhWqbFNDRFp4P/i8eqQYWzV6mbrPZKvYfF2HN
KWleeHMIIeMVcDpC2F/3rYIla0A+SMQqrKzPkbYJh10hEbdiEG/mDuYuYkISD/pf
Hud9a216bfZdj/naQzyc+0m4bae5Q7viudseX1oFDyHbSTGzEoWcPtakdp+BmYQ7
TsPJm9XsT0F29U0+hQBGOBzzkg5uP+56seou7wZ7WcmuWzLrbWGF8wPJ/XFitqjz
N7VN+Ckpd2jsRvlSNCEutS10pBXeH53NB4OWOMcfhOY3Xp2w6sqP3sOopvZZvoBz
u468Q2gd7bOmwfKnLKeeuO/JLrN8AJ2wH1vEXPwrVUgXj15Sf34j36XIpcLfTAVK
UH3FQ/xq57sdh79Ixa3E6uhlYOtLV9jF6+1Vt9eMApue6ERuv6phmXI6Ni1BM+hW
5pFXJJN/r/rAyTaY8cZLNV56OSPIRE95sJ2bWJ535W/4Unqt+pbTK4FRPBdBJNf3
IKPeh+Uxt7f3HbUwSWA72/1qOWH5yWQs6tanovg2CGwmoTzpRwz5ho+ARjjUljHq
tFfiVrsytW9bF16ffXVpUUnAAIqCWm/ZnTXlS96Xuqdj9pW0jTuW9EA8fzsYMQcL
nCf8gxHTPGW87P0v9Sf3IxmKp95X3QEdy+WdoH/F/UWTEp4uqICuiMVxwawv3AFL
G+xXItIFLYST0JUA0EiQ
=mBX/
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.