Bug 1040378 (CVE-2013-7060)

Summary:	CVE-2013-7060 plone: filesystem path information leak
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	cluster-maint, extras-orphan, jkurik, jrusnack, rmccabe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-02-17 14:56:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1040380
Bug Blocks:	1040399

Description Ratul Gupta 2013-12-11 10:25:18 UTC

Plone, an open source content management system, was found to be affected by a vulnerability, that could allow remote attackers to obtain the path to a plone installation.

A file object that points to documentation is initialised in class scope and not cleaned up. This object can be traversed to through the web, revealing the repr, including the path of the software installation.

Responsible code:
https://github.com/plone/Products.CMFPlone/blob/b08a45bc12b1bd42411f1130a487a7a242349ea0/Products/CMFPlone/FactoryTool.py#L272-L274

References:
http://seclists.org/oss-sec/2013/q4/467
https://plone.org/security/20131210/path-leak

Comment 1 Ratul Gupta 2013-12-11 10:26:46 UTC

Created plone tracking bugs for this issue:

Affects: epel-5 [bug 1040380]

Comment 2 Ratul Gupta 2013-12-13 05:55:38 UTC

CVE Request:
http://seclists.org/oss-sec/2013/q4/467

Comment 4 Vincent Danen 2015-02-17 14:56:42 UTC

Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.