Bug 830254 (CVE-2012-2682)

Summary:	CVE-2012-2682 cumin: DoS via displayed link names containing non-ASCII characters
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	djorm, eerlands, fweimer, grid-maint-list, matt, security-response-team, sgraf, tmckay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that if Cumin were asked to display a link name containing non-ASCII characters, the request would terminate with an error. If data containing non-ASCII characters were added to the database (such as via Cumin or Wallaby), requests to load said data would terminate and the requested page would not be displayed until an administrator cleans the database.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-09 09:40:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	807986
Bug Blocks:	858767

Description Vincent Danen 2012-06-08 16:22:15 UTC

It was found that when Cumin was asked to display a link name that contained non-ASCII characters, it would exit with an error and not display the content of the page with the link in it.  Due to incomplete support for Unicode, if an administrator were to add data to the database (via Cumin or Wallaby, among others) that contained non-ASCII characters, subsequent requests to load data containing these characters would result in unexpected termination of the Cumin request, and the requested page would not be displayed.

Comment 4 Vincent Danen 2012-09-19 16:07:19 UTC

Acknowledgements:

This issue was discovered by Stanislav Graf of Red Hat.

Comment 5 Martin Prpič 2014-07-09 07:35:12 UTC

IssueDescription:

It was found that if Cumin were asked to display a link name containing non-ASCII characters, the request would terminate with an error. If data containing non-ASCII characters were added to the database (such as via Cumin or Wallaby), requests to load said data would terminate and the requested page would not be displayed until an administrator cleans the database.

Comment 6 errata-xmlrpc 2014-07-09 08:50:11 UTC

This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2014:0859 https://rhn.redhat.com/errata/RHSA-2014-0859.html

Comment 7 errata-xmlrpc 2014-07-09 08:50:19 UTC

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2014:0858 https://rhn.redhat.com/errata/RHSA-2014-0858.html