Bug 879684 (CVE-2012-5567)

Summary:	CVE-2012-5567 kronolith: Multiple XSS flaws in the portal blocks
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	j, nb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Kronolith 3.0.18	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-13 03:32:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	879686, 879687
Bug Blocks:

Description Jan Lieskovsky 2012-11-23 17:10:05 UTC

A cross-site scripting (XSS) flaw was found in the way Kronolith, the Horde calendar application, sanitized content of certain event location parameters passed to month, monthlist and prevmonthlist application fields. A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or webscript execution.

References:
[1] http://lists.horde.org/archives/announce/2012/000836.html
[2] https://github.com/horde/horde/blob/d3dda2d47fad7eb128a0091e732cded0c2601009/kronolith/docs/CHANGES

Refevant upstream patch:
[3] http://git.horde.org/horde-git/-/commit/d865c564beb6e98532880aa51a04a79f3311cd1e

Comment 1 Jan Lieskovsky 2012-11-23 17:11:37 UTC

These issues affect the versions of kronolith package, as shipped with Fedora release of 16 and 17. Please schedule an update.

--

These issues affect the versions of the kronolith package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.

Comment 2 Jan Lieskovsky 2012-11-23 17:12:41 UTC

Created kronolith tracking bugs for this issue

Affects: fedora-all [bug 879686]
Affects: epel-all [bug 879687]

Comment 3 Jan Lieskovsky 2012-11-23 17:26:59 UTC

CVE Request:
  http://www.openwall.com/lists/oss-security/2012/11/23/3

Comment 4 Jan Lieskovsky 2012-11-26 10:09:06 UTC

The CVE identifier of CVE-2012-5567 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2012/11/23/7

Comment 5 Nick Bebout 2012-12-13 03:32:12 UTC

Resolving as WONTFIX.  

We are working on packaging the new pear-based Horde, so this will eventually be fixed when that is finished.