Description of problem: The generated gravatar HTML wasn't handling escaping of the display name of the user, allowing an attacker to choose a name that would close out the <img> tag and inject a <script> tag. By switching to Django's format_html(), we can guarantee safe escaping of content. Version-Release number of selected component (if applicable): python-djblets-0.8.2-1.fc21 python-djblets-0.7.29-1.fc20 How reproducible: Every time Steps to Reproduce: 1. User can change their display name to "</script><script> alert(1)</script>" 2. Configure this user for a Gravatar image 3. Browse to any page displaying the gravatar image Actual results: The script executes Expected results: The username should be properly sanitized and prevent XSS execution. Additional info: Issue is non-public, but was discovered during further investigation around the public bug in BZ #1105551 Credit for the discovery of this vulnerability should be given to Christian Hammond of Bean Bag, Inc. (author of Review Board). This issue is present in the python-djblets package on Fedora 19, 20, Rawhide and EPEL 6 (EPEL 7 has not yet had a successful build). Upstream patch: Djblets 0.7.x: https://reviews.reviewboard.org/r/5947/diff/ Djblets 0.8.x: https://reviews.reviewboard.org/r/5946/diff/
Upstream has requested CVEs be issued for this and BZ #1105551. My personal opinion is that they can probably be treated as a single CVE.
python-djblets-0.7.30-2.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/python-djblets-0.7.30-2.fc20
python-djblets-0.7.30-2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/python-djblets-0.7.30-2.fc19
Package python-djblets-0.7.30-2.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing python-djblets-0.7.30-2.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-7223/python-djblets-0.7.30-2.fc20 then log in and leave karma (feedback).
python-djblets-0.7.30-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-djblets-0.7.30-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.