Bug 1353562 (CVE-2016-1000007)

Summary:	CVE-2016-1000007 pagure: XSS in raw file endpoint
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bruno, pingou, puiterwijk
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pagure 2.2.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-07 13:07:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Prpič 2016-07-07 13:06:31 UTC

It was found that Pagure served files in user repositories from its raw endpoint with content types that instructed the browser to parse HTML files which could lead to Cross-Site Scripting attack.

References:

http://seclists.org/oss-sec/2016/q3/6

Upstream patch:

https://pagure.io/pagure/c/070d63983fe5daef92005ea33d3b8c693c224c77

Comment 1 Martin Prpič 2016-07-07 13:07:52 UTC

Updates are available for Fedora and EPEL:

pagure-2.2.2-1.fc24
pagure-2.2.2-1.el7 
pagure-2.2.2-1.fc25

Comment 2 Bruno Wolff III 2016-07-07 14:14:27 UTC

f23 and f22 have much older versions of Pagure and I don't know if the bug applies to them. Updating them to more recent versions could cause problems in theory, but I doubt anyone is self hosting with the f22 or f23 distro versions.

Comment 3 Pierre-YvesChibon 2016-07-07 17:08:11 UTC

(In reply to Bruno Wolff III from comment #2)
> f23 and f22 have much older versions of Pagure and I don't know if the bug
> applies to them. 

It does actually :(

> Updating them to more recent versions could cause problems
> in theory, but I doubt anyone is self hosting with the f22 or f23 distro
> versions.

I share this thought :)

Comment 4 Patrick Uiterwijk 2016-07-25 05:59:17 UTC

(In reply to Pierre-YvesChibon from comment #3)
> (In reply to Bruno Wolff III from comment #2)
> > f23 and f22 have much older versions of Pagure and I don't know if the bug
> > applies to them. 
> 
> It does actually :(

Do note that the patch in 2.2.2 is small enough that it can be applied to those too.