Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 05 Jul 2019 16:31:36 +1000
From: Daniel Axtens <>
Cc: Andrew Donnellan <>
Subject: CVE-2019-13122: Patchwork: XSS via Message-ID 


Patchwork is a web-based patch tracking system designed to facilitate
the contribution and management of contributions to an open-source
project that uses a mailing list for contributions.

Andrew Donnellan discovered an XSS via the message-id field. A malicious
party could send a patch with a message ID that included a script
tag. Because of the quirks of the email RFCs, such a message ID can
survive being sent through many mail systems, including Gmail, and be
parsed and stored by Patchwork. When a user views a patch detail page
for the patch with this message id, the script would be run.

This is due to an erroneous mark_safe() in the template tag that
renders message IDs. This has been present since v1.1 of upstream
Patchwork, but does not affect the FreeDesktop fork.

Over the last few days, we have disclosed this bug to the admins of
patchwork instances that we could identify. Several key instances have
already been patched.

The vulnerability is fixed in Patchwork v2.1.4 and v2.0.4, which have
just been released.

Kind regards,
Daniel Axtens
Patchwork maintainer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.