Bug 432747 (CVE-2008-0780)

Summary:	CVE-2008-0780 MoinMoin XSS in login action
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	matthias
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://hg.moinmo.in/moin/1.5/rev/2f952fa361c7
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-24 11:13:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	432749, 432750
Bug Blocks:

Description Lubomir Kundrak 2008-02-14 04:40:33 UTC

Description of problem:

The following fix was commited to 1.5 branch in upstream repository:
http://hg.moinmo.in/moin/1.5/rev/2f952fa361c7

"XSS fix for login action, thanks to Fernando Quintero for reporting this"

Comment 1 Lubomir Kundrak 2008-02-14 04:48:40 UTC

CVE name was requested.

Comment 3 Lubomir Kundrak 2008-02-19 18:05:20 UTC

Ping on this. Matthias do you need help updating the package?

Comment 4 Matthias Saou 2008-02-19 19:03:27 UTC

Oh, yes... very very busy... feel free to commit the patch to all relevant
branches. Note also that the previous security patch probably needs to be
applied to the devel branch too.

Comment 5 Fedora Update System 2008-02-20 11:34:03 UTC

moin-1.5.8-4.fc8 has been submitted as an update for Fedora 8

Comment 6 Fedora Update System 2008-02-20 11:36:52 UTC

moin-1.5.8-4.fc7 has been submitted as an update for Fedora 7

Comment 7 Fedora Update System 2008-02-21 02:55:08 UTC

moin-1.5.8-4.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2008-02-21 02:57:14 UTC

moin-1.5.8-4.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Red Hat Product Security 2008-04-24 11:13:36 UTC

This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1880
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1905