Bug 843919 (CVE-2012-1969)

Summary: CVE-2012-1969 bugzilla: information leak (description of private attachments)
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: itamar, xavier
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20120726,reported=20120726,source=gentoo,cvss2=5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N,fedora-all/bugzilla=affected,epel-all/bugzilla=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 843921, 843920    
Bug Blocks:    

Description Vincent Danen 2012-07-27 12:34:07 EDT
From the upstream advisory [1]:

Class:       Information Leak
Versions:    2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
Fixed In:    3.6.10, 4.0.7, 4.2.2, 4.3.2
Description: The description of a private attachment could be visible
             to a user who hasn't permissions to access this attachment
             if the attachment ID is mentioned in a public comment in
             a bug that the user can see.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=777586
CVE Number:  CVE-2012-1969

This issue would affect Bugzilla as provided by all versions of Fedora and EPEL.

Additionally, another flaw is noted in the same advisory (CVE-2012-1968: information leak via HTML bug mails), but that flaw only affects Bugzilla 4.1.1 and higher (which is not yet provided in Fedora, but 4.2.1 is in Rawhide, which should be updated to 4.2.2).

[1] http://www.bugzilla.org/security/3.6.9/
Comment 1 Vincent Danen 2012-07-27 12:36:30 EDT
Created bugzilla tracking bugs for this issue

Affects: fedora-all [bug 843920]
Affects: epel-all [bug 843921]
Comment 2 Fedora Update System 2012-08-12 22:21:42 EDT
bugzilla-4.0.7-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2012-08-12 22:22:03 EDT
bugzilla-4.0.7-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.