Bug 890904 (CVE-2012-6080)

Summary:	CVE-2012-6080 moinmoin: Path traversal vulnerability
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, imlinux+fedora, ivazqueznet, jlieskov, vpvainio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:58:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	890906, 890907
Bug Blocks:

Description Huzaifa S. Sidhpurwala 2012-12-31 04:23:31 UTC

A path traversal issue was found in MoinMoin wiki (version 1.9.3 -1.9.5). The vulnerability resides in the AttachFile action (function
_do_attachment_move in action/AttachFile.py). It fails to properly sanitize file names.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 

This issue has been assgined CVE-2012-6080

Reference:
http://seclists.org/oss-sec/2012/q4/524

Comment 1 Huzaifa S. Sidhpurwala 2012-12-31 04:28:24 UTC

Created moin tracking bugs for this issue

Affects: fedora-all [bug 890906]
Affects: epel-5 [bug 890907]

Comment 2 Jan Lieskovsky 2013-01-03 11:06:39 UTC

(Further) References:
---------------------
http://www.openwall.com/lists/oss-security/2012/12/30/6
https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599
http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52
http://moinmo.in/SecurityFixes
http://www.debian.org/security/2012/dsa-2593
http://ubuntu.com/usn/usn-1680-1
http://www.securityfocus.com/bid/57076
http://secunia.com/advisories/51663
http://secunia.com/advisories/51676
http://secunia.com/advisories/51696

Comment 3 Fedora Update System 2013-01-20 02:56:16 UTC

moin-1.9.6-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-01-23 01:38:50 UTC

moin-1.9.6-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2013-01-23 02:00:30 UTC

moin-1.9.6-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.