Bug 713478 (CVE-2011-2919)

Summary:	CVE-2011-2919 RHN Satellite / Spacewalk: XSS on SystemGroupList.do page
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cperry, csuleski, d.muturi, eliningt, jpazdziora, jskrabal, liko, mjc, mmraka, mzazrivec, security-response-team, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-09-16 06:48:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	730925, 738818
Bug Blocks:	622406, 713496

Description Jan Lieskovsky 2011-06-15 14:09:55 UTC

It was found that application for listing of system groups in Red Hat Network
Satellite Server and Spacewalk services did not properly HTML escape
the content of QueryString. A remote attacker could use this flaw to conduct
XSS attacks, potentially leading into attacker's ability to steal
the users' session cookie.

Acknowledgements:

Red Hat would like to thank Daniel Karanja Muturi for reporting this issue.

Comment 11 errata-xmlrpc 2011-09-15 17:55:26 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2011:1299 https://rhn.redhat.com/errata/RHSA-2011-1299.html

Comment 12 Vincent Danen 2011-09-15 21:24:09 UTC

Created spacewalk-backend tracking bugs for this issue

Affects: fedora-all [bug 738818]

Comment 13 Jan Pazdziora 2011-09-16 06:41:50 UTC

(In reply to comment #12)
> Created spacewalk-backend tracking bugs for this issue
> 
> Affects: fedora-all [bug 738818]

I don't quite understand -- the problem (and the fix) is not in spacewalk-backend package.

Comment 14 Jan Pazdziora 2011-09-16 09:32:20 UTC

Fixed in Spacewalk master, commit 2d9c34e7b682b375ea32595f0dd38b61f424a24f, tagged as spacewalk-java-1.6.46-1.

Comment 15 Vincent Danen 2011-09-16 17:40:13 UTC

Sorry, thanks for the Jan.  When initially filing this, I suspect some random spacewalk component was selected for the purpose of tracking bugs.  Thank you for clearing it up and resolving that invalid tracker.