Bug 876371 (CVE-2012-5522, CVE-2012-5523)

Summary: CVE-2012-5522 CVE-2012-5523 mantis: multiple security flaws fixed in version 1.2.12
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: extras-orphan, giallu, guillaume, jlieskov, sven
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20121109,reported=20121113,source=oss-security,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,fedora-all/mantis=affected,epel-5/mantis=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-15 00:17:08 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 800667, 876372    
Bug Blocks:    

Description Vincent Danen 2012-11-13 18:29:07 EST
Two flaws were noted as being fixed in the Mantis 1.2.12 changelog [1]:

- 0014496: [security] Workflow Transitions: Minimal Access Level to Change to this status has no correct 'default' (dregad)
- 0014704: [security] Clone and Move issue with Copy bug notes - user get email notice from project without access (dregad)

[1] http://www.mantisbt.org/bugs/changelog_page.php?version_id=150
Comment 1 Vincent Danen 2012-11-13 18:33:03 EST
Created mantis tracking bugs for this issue

Affects: fedora-all [bug 876372]
Affects: epel-5 [bug 830742]
Comment 2 Jan Lieskovsky 2012-11-14 03:53:48 EST
Based on http://www.openwall.com/lists/oss-security/2012/11/14/1:

* the CVE identifier of CVE-2012-5522 has been assigned to the:

    http://www.mantisbt.org/bugs/view.php?id=14496 issue and

* CVE identifier of CVE-2012-5523 has been assigned to the:

    http://www.mantisbt.org/bugs/view.php?id=14704 issue.
Comment 3 Fedora Update System 2012-11-23 02:56:16 EST
mantis-1.2.12-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2012-11-23 22:24:33 EST
mantis-1.2.12-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-11-23 22:25:33 EST
mantis-1.2.12-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Vincent Danen 2013-03-15 00:17:08 EDT
EPEL5 hasn't been touched since Dec 2010, and the package is technically orphaned.  As a result I'm closing this bug as this issue is fixed in Fedora.  The EPEL5 tracking bug #800667 will remain open until either mantis is dropped from EPEL or it is fixed.