PT-2019-13137 · Patchwork · Patchwork

Andrew Donnellan · Published 2019-07-10 · Updated 2019-07-16 · CVE-2019-13122

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Patchwork versions 1.1 through 2.1.x

Description A Cross Site Scripting (XSS) issue exists in the template tag used to render message ids. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. The msgid function in templatetags/patch.py is affected.

Recommendations For versions prior to 2.1.4 and 2.0.4, update to version 2.1.4 or 2.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the msgid function in templatetags/patch.py until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13122

Affected Products

Patchwork

References · 11

• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html · Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13122 · Security Note
• http://jk.ozlabs.org/projects/patchwork · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-13122 · Vendor Advisory
• https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html · Vendor Advisory
• https://github.com/getpatchwork/patchwork/releases · Note
• https://github.com/getpatchwork/patchwork/commits/master · Note
• http://openwall.com/lists/oss-security/2019/07/05/1 · Note
• https://security.alpinelinux.org/vuln/CVE-2019-13122 · Note