[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8736jl0z7b.fsf@dja-thinkpad.axtens.net>
Date: Fri, 05 Jul 2019 16:31:36 +1000
From: Daniel Axtens <dja@...ens.net>
To: oss-security@...ts.openwall.com
Cc: Andrew Donnellan <ajd@...ux.ibm.com>
Subject: CVE-2019-13122: Patchwork: XSS via Message-ID
Hello,
Patchwork is a web-based patch tracking system designed to facilitate
the contribution and management of contributions to an open-source
project that uses a mailing list for contributions.
(http://jk.ozlabs.org/projects/patchwork/)
Andrew Donnellan discovered an XSS via the message-id field. A malicious
party could send a patch with a message ID that included a script
tag. Because of the quirks of the email RFCs, such a message ID can
survive being sent through many mail systems, including Gmail, and be
parsed and stored by Patchwork. When a user views a patch detail page
for the patch with this message id, the script would be run.
This is due to an erroneous mark_safe() in the template tag that
renders message IDs. This has been present since v1.1 of upstream
Patchwork, but does not affect the FreeDesktop fork.
Over the last few days, we have disclosed this bug to the admins of
patchwork instances that we could identify. Several key instances have
already been patched.
The vulnerability is fixed in Patchwork v2.1.4 and v2.0.4, which have
just been released.
Kind regards,
Daniel Axtens
Patchwork maintainer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
