[<prev] [next>] [day] [month] [year] [list]
Message-ID: <57278CD6.2030209@shadura.me>
Date: Mon, 2 May 2016 19:22:30 +0200
From: Andrew Shadura <andrew@...dura.me>
To: Kallithea <kallithea-general@...onservancy.org>
Cc: oss-security@...ts.openwall.com
Subject: [SECURITY ISSUES] CVE-2016-3691 and CVE-2016-3114
Hello everyone,
We've discovered the following security issues in Kallithea.
CVE-2016-3114: Privilege escalation
===================================
The vulnerability that allowed logged-in users to edit or
delete open pull requests associated with any repository to which
they had read access, plus a related vulnerability allowing logged-in
users to delete any comment from any repository, provided they could
determine the comment ID and had read access to just one repository.
CVE-2016-3691: CSRF protection bypass
=====================================
Routes allows GET requests to override the HTTP method, which breaks
the Kallithea CSRF protection (which only applies to POST requests).
The attacker might misuse GET requests method overriding to trick user
into issuing a request with a different method, thus bypassing the
CSRF protection.
Resolution
==========
Søren Løvborg wrote patches fixing these issues, both of which are
included in the release 0.3.2. Users are advised to upgrade as soon as
possible.
--
Cheers,
Andrew
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
