Bug 1941741 (CVE-2019-14829)

Summary:	CVE-2019-14829 moddle: Activity :addinstance capabilities were not respected when creating a course in single activity format
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gwync, igor.raits
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Moodle where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:29:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1941745
Bug Blocks:

Description Guilherme de Almeida Suckevicz 2021-03-22 16:42:10 UTC

A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.

Reference:
https://moodle.org/mod/forum/discuss.php?d=391035

Upstream patch:
https://git.moodle.org/gw?p=moodle.git;a=commit;h=208397c120b6bf74ca6a173e42cb527904c5ab42

Comment 1 Guilherme de Almeida Suckevicz 2021-03-22 16:51:48 UTC

Created moodle tracking bugs for this issue:

Affects: epel-all [bug 1941745]