Bug 647832 (CVE-2010-4245)
| Summary: | CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dwayne Bailey <dwayne> |
| Component: | pootle | Assignee: | Dwayne Bailey <dwayne> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | urgent | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | security-response-team, vdanen |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.xssed.com/mirror/70160/ | ||
| Whiteboard: | |||
| Fixed In Version: | pootle-2.1.2-1.el5 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-11-08 22:33:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Dwayne Bailey
2010-10-29 15:48:16 UTC
This is fixed upstream for 2.1: http://translate.svn.sourceforge.net/viewvc/translate/src/branches/Pootle-2.1/local_apps/pootle_store/views.py?r1=16167&r2=16166&pathrev=16167 This will be fixed with upstreams release of 2.1.2 bug fix release. I see that 2.1.2 is now available: http://sourceforge.net/projects/translate/files/Pootle/2.1.2/ But the README.txt there does not mention this security flaw. Requesting clarification on whether we can make this bug public and get updates into Fedora. Sorry, RELEASE.txt. RELEASE.txt contains: This release includes an important security fix to a cross site scripting vulnerability in the translate page. All users are encouraged to upgrade immediately. Fedora updates are submitted already, making this public so this bug can be added to the bodhi update request. pootle-2.1.2-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc14 pootle-2.1.2-1.el5 has been submitted as an update for Fedora EPEL 5. https://admin.fedoraproject.org/updates/pootle-2.1.2-1.el5 pootle-2.1.2-1.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc13 pootle-2.1.2-1.fc12 has been submitted as an update for Fedora 12. https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12 pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update pootle'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12 pootle-2.1.2-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report. pootle-2.1.2-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. pootle-2.1.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report. This issue was assigned the name CVE-2010-4245. |