Date: Fri, 05 Jul 2019 16:31:36 +1000 From: Daniel Axtens <dja@...ens.net> To: oss-security@...ts.openwall.com Cc: Andrew Donnellan <ajd@...ux.ibm.com> Subject: CVE-2019-13122: Patchwork: XSS via Message-ID Hello, Patchwork is a web-based patch tracking system designed to facilitate the contribution and management of contributions to an open-source project that uses a mailing list for contributions. (http://jk.ozlabs.org/projects/patchwork/) Andrew Donnellan discovered an XSS via the message-id field. A malicious party could send a patch with a message ID that included a script tag. Because of the quirks of the email RFCs, such a message ID can survive being sent through many mail systems, including Gmail, and be parsed and stored by Patchwork. When a user views a patch detail page for the patch with this message id, the script would be run. This is due to an erroneous mark_safe() in the template tag that renders message IDs. This has been present since v1.1 of upstream Patchwork, but does not affect the FreeDesktop fork. Over the last few days, we have disclosed this bug to the admins of patchwork instances that we could identify. Several key instances have already been patched. The vulnerability is fixed in Patchwork v2.1.4 and v2.0.4, which have just been released. Kind regards, Daniel Axtens Patchwork maintainer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.