Bug 1255170 – CVE-2015-5216 ipsilon: XSS due to exception handling

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1255170 - (CVE-2015-5216) CVE-2015-5216 ipsilon: XSS due to exception handling

Summary:	CVE-2015-5216 ipsilon: XSS due to exception handling

Status:	NEW

Aliases:	CVE-2015-5216

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150819,repor...
Keywords:	Security

Depends On:	1255176 1255775
Blocks:	1255174
	Show dependency tree / graph

Reported:	2015-08-19 16:25 EDT by Kurt Seifried
Modified:	2016-11-08 11:21 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	A flaw was discovered in the Ipsilon IdP server in its use of Python templates, where JavaScript code could potentially be injected into an Python exception-message template. A remote, unauthorised attacker could use this flaw to perform an XXS attack.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Kurt Seifried 2015-08-19 16:25:35 EDT

Michael Scherer of Red Hat reports:

ipsilon does not escape HTML when processing http(s) request responses, allowing to inject js code into Python exception message template.

Upstream patch:

https://pagure.io/ipsilon/a503aa9c2a30a74e709d1c88099befd50fb2eb16

Comment 1 Kurt Seifried 2015-08-19 16:36:03 EDT

Created ipsilon tracking bugs for this issue:

Affects: fedora-all [bug 1255176]

Comment 3 Viliam Križan 2015-08-24 04:58:49 EDT

Acknowledgement:

This issue was discovered by Michael Scherer of Red Hat.

Comment 5 Ilya Etingof 2015-08-24 05:19:38 EDT

Analysis:

It was found that js code could potentially be injected into Python exception message template.

Note You need to log in before you can comment on or make changes to this bug.