Bug 890903 (CVE-2012-6082)

Summary:	CVE-2012-6082 moinmoin: Wiki (XSS in rss link)
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, imlinux+fedora, ivazqueznet, jlieskov, vpvainio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:58:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	890906, 890907
Bug Blocks:

Description Huzaifa S. Sidhpurwala 2012-12-31 04:18:07 UTC

A Cross-site scripting (XSS) was found in  MoinMoin wiki, version 1.9.5. Function rsslink() in "theme/__init__.py" does not properly escape the page name parameter.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/c98ec456e493 

This issue has been assigned CVE-2012-6082.

Reference:
http://seclists.org/oss-sec/2012/q4/523

Comment 1 Huzaifa S. Sidhpurwala 2012-12-31 04:27:28 UTC

Created moin tracking bugs for this issue

Affects: fedora-all [bug 890906]
Affects: epel-5 [bug 890907]

Comment 2 Jan Lieskovsky 2013-01-03 11:10:35 UTC

(Further) References:
---------------------
http://www.openwall.com/lists/oss-security/2012/12/29/7
http://www.openwall.com/lists/oss-security/2012/12/30/5
http://hg.moinmo.in/moin/1.9/rev/c98ec456e493
http://moinmo.in/SecurityFixes
http://www.securityfocus.com/bid/57089
http://secunia.com/advisories/51663

Comment 3 Fedora Update System 2013-01-20 02:56:09 UTC

moin-1.9.6-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-01-23 01:38:41 UTC

moin-1.9.6-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2013-01-23 02:00:13 UTC

moin-1.9.6-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.