Bug 679411 (CVE-2011-1008)

Summary:	CVE-2011-1008 rt3: SQL queries information leak by user account transition
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	mmahut, ovitters, rc040203, tremble, vdanen, xavier
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rt3 3.8.9	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-10-05 20:52:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	680217, 680218
Bug Blocks:

Description Jan Lieskovsky 2011-02-22 14:21:05 UTC

A security flaw was found in the way the RT3 ticketing
system handled logging of SQL queries during performing
of user account transition. A remote, authenticated RT3
user could use this flaw to obtain sensitive information.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576
[2] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

Upstream changeset (needs confirmation from upstream if it's
real fix for the issue yet):
[3] https://github.com/bestpractical/rt/commit/56e20b874e8d67ab93aa80c2c00155110a27e764

Comment 1 Jan Lieskovsky 2011-02-22 14:37:37 UTC

CVE Request:
[4] http://www.openwall.com/lists/oss-security/2011/02/22/6

Comment 2 Vincent Danen 2011-02-24 17:10:39 UTC

This was assigned CVE-2011-1008:

http://www.openwall.com/lists/oss-security/2011/02/22/12

Upstream indicated that the above changeset is not the fix, but this one is:

https://github.com/bestpractical/rt/commit/2338cd19ed7a7f4c1e94f639ab2789d6586d01f3

This is fixed in upstream version 3.8.9.

Comment 3 Vincent Danen 2011-02-24 17:24:27 UTC

Created rt3 tracking bugs for this issue

Affects: fedora-all [bug 680218]
Affects: epel-6 [bug 680217]

Comment 4 Fedora Update System 2011-10-27 19:06:09 UTC

rt3-3.6.11-2.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.