Bug 974654

Summary:	conga (Plone): HTTP injection via benevolent cookie setting method triggered by malicious URL (accessed by authorized user)
Product:	[Other] Security Response	Reporter:	Jan Pokorný [poki] <jpokorny>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fdinitto, jlieskov, rmccabe, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	CVE-2013-6496	Environment:
Last Closed:	2015-01-20 17:27:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	956861
Bug Blocks:	971604

Comment 3 Jan Lieskovsky 2013-06-21 09:36:42 UTC

A HTTP injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP cookie values provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, then visited by an authenticated Plone user would lead to arbitrary HTML or web script execution in the context of the Plone user's session.

A different vulnerability than CVE-2012-5486.

Acknowledgements:

This issue was discovered by Jan Pokorny of Red Hat.

Comment 4 Jan Lieskovsky 2013-06-21 09:38:53 UTC

This issue affects the version of the conga package, as shipped with Red Hat Enterprise Linux 5.

Comment 5 Vincent Danen 2015-01-20 17:27:41 UTC

Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.