Bug 620751 (CVE-2010-2796)

Summary:	CVE-2010-2796 php-pear-CAS: XSS in proxy mode (PHPCAS-67)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, gwync
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-22 06:12:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	620753, 620759, 620772
Bug Blocks:

Description Jan Lieskovsky 2010-08-03 12:07:56 UTC

Joachim Fritschi (upstream phpCAS developer) noticed:
  [1] https://issues.jasig.org/browse/PHPCAS-67

the Central Authentication Service (CAS) client library improperly
encoded the callback URLs (generated to validate service tickets) 
provided to CAS proxies. A remote attacker could use this flaw
to conduct cross-site scripting (XSS) attacks by providing a specially-crafted
value for service ticket.

Upstream patch:
  [2] https://developer.jasig.org/source/changelog/jasigsvn/cas-clients/phpcas/trunk/source?cs=20823

Comment 1 Jan Lieskovsky 2010-08-03 12:09:20 UTC

This flaw affects the versions of the php-pear-CAS package, as shipped
with Fedora release of 12 and 13.

Please fix.

Comment 3 Jan Lieskovsky 2010-08-03 12:33:12 UTC

This issue affects the versions of the glpi package, as shipped
with Fedora release of 12 and 13.

Please fix.

Comment 6 Jan Lieskovsky 2010-08-03 12:53:36 UTC

This issue affects the versions of the moodle package, as shipped
with Fedora release of 12 and 13.

This issue affects the versions of the moodle package, as shipped
within EPEL-4 and EPEL-5 repositories.

Please fix.

Comment 7 Jan Lieskovsky 2010-08-03 13:11:41 UTC

Created php-pear-CAS tracking bugs for this issue

Affects: fedora-all [bug 620753]

Comment 8 Jan Lieskovsky 2010-08-03 13:11:44 UTC

Created glpi tracking bugs for this issue

Affects: fedora-all [bug 620759]

Comment 9 Jan Lieskovsky 2010-08-03 13:11:46 UTC

Created moodle tracking bugs for this issue

Affects: fedora-all [bug 620772]

Comment 10 Remi Collet 2010-08-03 15:50:47 UTC

glpi is not affected as it (now) uses the system version of phpCas.