PT-2019-13137 · Patchwork · Patchwork

Andrew Donnellan · Publicado 2019-07-10 · Atualizado 2019-07-16 · CVE-2019-13122

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Patchwork versions 1.1 through 2.1.x

Description A Cross Site Scripting (XSS) issue exists in the template tag used to render message ids. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. The msgid function in templatetags/patch.py is affected.

Recommendations For versions prior to 2.1.4 and 2.0.4, update to version 2.1.4 or 2.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the msgid function in templatetags/patch.py until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13122

Produtos afetados

Patchwork

Referências · 11

• https://github.com/getpatchwork/patchwork/releases · Nota
• https://github.com/getpatchwork/patchwork/commits/master · Nota
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html · Aviso do Fabricante
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-13122 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13122 · Nota de Segurança
• http://jk.ozlabs.org/projects/patchwork · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2019-13122 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/07/05/1 · Nota
• https://security.alpinelinux.org/vuln/CVE-2019-13122 · Nota
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html · Aviso do Fabricante