Bug 674144 (CVE-2010-3854)

Summary:	CVE-2010-3854 couchdb: XSS vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lemenkov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:57:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	674145, 674146
Bug Blocks:

Description Vincent Danen 2011-01-31 19:00:24 UTC

A cross-site scripting flaw was reported in Apache CouchDB 0.8.0 to 1.0.1 [1].  This flaw has been corrected in version 1.0.2.

Due to inadequate validation of request parameters and cookie data in Futon, CouchDB's web-based administration UI, a malicious site can execute arbitrary code in the context of a user's browsing session.

[1] http://mail-archives.apache.org/mod_mbox/couchdb-dev/201101.mbox/%3cC840F655-C8C5-4EC6-8AA8-DD223E39C34A@apache.org%3e

Comment 1 Vincent Danen 2011-01-31 19:01:35 UTC

Created couchdb tracking bugs for this issue

Affects: fedora-all [bug 674145]
Affects: epel-all [bug 674146]

Comment 2 Peter Lemenkov 2011-02-20 12:45:51 UTC

Almost done with this - fixed builds were pulled in F-14, F-15, EL-6.

Unfortunately, it seems that it couldn't be easy to fix EL-5 (it will require upgrade from 0.11.2 to recent 1.0.2). I'll consider upgrading next week.

No luck for F-13 also.

Comment 3 Peter Lemenkov 2011-06-18 13:15:18 UTC

The only missing branch is EL-5. I plan to upgrade coiuchdb from 0.11.2 to 1.0.2 very soon.

Comment 4 Product Security DevOps Team 2019-06-10 10:57:39 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.