Bug 647832 (CVE-2010-4245)

Summary: CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page
Product: [Fedora] Fedora Reporter: Dwayne Bailey <dwayne>
Component: pootleAssignee: Dwayne Bailey <dwayne>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: low    
Version: 13CC: security-response-team, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.xssed.com/mirror/70160/
Whiteboard:
Fixed In Version: pootle-2.1.2-1.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-11-08 22:33:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Dwayne Bailey 2010-10-29 15:48:16 UTC
User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:2.0b8pre) Gecko/20101029 Firefox/4.0b8pre

Pootle allows XSS on the match_names parameter when searching for matching check failures.



Reproducible: Always

Steps to Reproduce:
1. Run this URL https://localize.mozilla.org/te/bugzilla_components/translate.html?match_names=check-isfuzzy,untranslated,%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E&view_mode=review
Actual Results:  
XSS possible

Expected Results:  
No XSS vulnerabilty

Comment 1 Dwayne Bailey 2010-10-29 15:50:20 UTC
This is fixed upstream for 2.1:
http://translate.svn.sourceforge.net/viewvc/translate/src/branches/Pootle-2.1/local_apps/pootle_store/views.py?r1=16167&r2=16166&pathrev=16167

This will be fixed with upstreams release of 2.1.2 bug fix release.

Comment 2 Vincent Danen 2010-10-29 20:47:52 UTC
I see that 2.1.2 is now available:

http://sourceforge.net/projects/translate/files/Pootle/2.1.2/

But the README.txt there does not mention this security flaw.  Requesting clarification on whether we can make this bug public and get updates into Fedora.

Comment 3 Vincent Danen 2010-10-29 20:48:19 UTC
Sorry, RELEASE.txt.

Comment 4 Tomas Hoger 2010-10-30 21:07:13 UTC
RELEASE.txt contains:

This release includes an important security fix to a cross site
scripting vulnerability in the translate page. All users are encouraged
to upgrade immediately.

Fedora updates are submitted already, making this public so this bug can be added to the bodhi update request.

Comment 5 Fedora Update System 2010-10-30 21:07:53 UTC
pootle-2.1.2-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc14

Comment 6 Fedora Update System 2010-10-30 21:08:20 UTC
pootle-2.1.2-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.el5

Comment 7 Fedora Update System 2010-10-30 21:08:24 UTC
pootle-2.1.2-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc13

Comment 8 Fedora Update System 2010-10-30 21:08:28 UTC
pootle-2.1.2-1.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12

Comment 9 Fedora Update System 2010-10-31 21:30:11 UTC
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update pootle'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12

Comment 10 Fedora Update System 2010-11-08 22:32:58 UTC
pootle-2.1.2-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2010-11-08 22:34:28 UTC
pootle-2.1.2-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2010-11-08 22:45:11 UTC
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2010-11-16 17:30:57 UTC
pootle-2.1.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Vincent Danen 2010-11-22 19:37:06 UTC
This issue was assigned the name CVE-2010-4245.