Bug 1295436 (CVE-2015-8508)

Summary: CVE-2015-8508 bugzilla: cross-site scripting when generating a dependency graph
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: itamar, perl-devel
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: bugzilla 4.2.16, bugzilla 4.4.11, bugzilla 5.0.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:46:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1295437    
Bug Blocks:    

Description Martin Prpič 2016-01-04 13:56:35 UTC
Upstream Bugzilla fixed the following issue:

During the generation of a dependency graph, the code for the HTML image map is generated locally if a local dot installation is used. With escaped HTML characters in a bug summary, it is possible to inject unfiltered HTML code in the map file which the CreateImagemap function generates. This could be used for a cross-site scripting attack.

This issue was fixed in versions 4.2.16, 4.4.11, and 5.0.2.

Upstream bug:


Comment 1 Martin Prpič 2016-01-04 13:56:55 UTC
Created bugzilla tracking bugs for this issue:

Affects: fedora-all [bug 1295437]

Comment 2 Product Security DevOps Team 2019-06-08 02:46:58 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.