Bug 490902 (CVE-2009-0934)

Summary:	CVE-2009-0934 ejabberd: XSS vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lemenkov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0934
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-03-19 06:33:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2009-03-18 14:32:16 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0934 to
the following vulnerability:

Name: CVE-2009-0934
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0934
Assigned: 20090317
Reference: MLIST:[oss-security] 20090316 CVE request: XSS in MUC logs of ejabberd
Reference: URL: http://www.openwall.com/lists/oss-security/2009/03/16/1
Reference: CONFIRM: http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_204
Reference: BID:34133
Reference: URL: http://www.securityfocus.com/bid/34133
Reference: SECUNIA:34340
Reference: URL: http://secunia.com/advisories/34340

Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4
allows remote attackers to inject arbitrary web script or HTML via
unknown vectors related to links and MUC logs.

Comment 1 Vincent Danen 2009-03-18 14:33:35 UTC

I see that 2.0.4 is in testing and rawhide, so it just needs to be pushed to stable/updates for this to be corrected.

Comment 2 Fedora Update System 2009-03-18 19:00:43 UTC

ejabberd-2.0.4-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2009-03-18 19:16:11 UTC

ejabberd-2.0.4-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Peter Lemenkov 2009-03-19 06:33:59 UTC

Ok, pushed to Fedora repositories. I'm closing this ticket.