[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <ea35113c-d493-4bf7-ca47-9df7891dde67@mantisbt.org>
Date: Sat, 27 Aug 2016 23:16:56 +0200
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: MantisBT weakened CSP when using bundled Gravatar plugin
Greetings,
Please assign a CVE ID for the following issue.
Description
-----------
MantisBT 1.3.0-rc.2 introduced a new bundled plugin to handle display of
users' avatars using Gravatar.
Instead of adding the Gravatar web site to the list of allowed image
sources in MantisBT's Content Security Policy, the plugin was replacing
the whole policy by:
img-src 'self' http://www.gravatar.com/
instead of the more strict default one of:
default-src 'self'; frame-ancestors 'none'; style-src 'self';
script-src 'self'
Relaxed policy allows execution of remote and inline scripts, e.g.
potentially enabling XSS attacks.
Affected versions
-----------------
- >= 1.3.0-rc.2
- >= 2.0.0-beta.1
Fixed in versions:
------------------
- 1.3.1
- 2.0.0-beta.2
As of this writing, these have not been released yet, but both should be
available in the coming days. Until then, installations should be
patched manually.
As a workaround, disabling the Gravatar plugin restores the safer
default policy.
Patch
-----
See Github [1]
Credits
-------
The issue was discovered by Johannes Schultz, and fixed by Victor Boctor
(MantisBT Developer).
References
----------
Further details available in our issue tracker [2]
Best regards,
D. Regad
MantisBT Developer
http://mantisbt.org
[1] https://github.com/mantisbt/mantisbt/commit/b3511d2f
[2] https://mantisbt.org/bugs/view.php?id=21263
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
