Bug 647832 - (CVE-2010-4245) CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page
CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: pootle (Show other bugs)
13
All Linux
low Severity urgent
: ---
: ---
Assigned To: Dwayne Bailey
Fedora Extras Quality Assurance
http://www.xssed.com/mirror/70160/
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-29 11:48 EDT by Dwayne Bailey
Modified: 2010-11-22 14:37 EST (History)
2 users (show)

See Also:
Fixed In Version: pootle-2.1.2-1.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-08 17:33:06 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Mozilla Foundation 606502 None None None Never

  None (edit)
Description Dwayne Bailey 2010-10-29 11:48:16 EDT
User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:2.0b8pre) Gecko/20101029 Firefox/4.0b8pre

Pootle allows XSS on the match_names parameter when searching for matching check failures.



Reproducible: Always

Steps to Reproduce:
1. Run this URL https://localize.mozilla.org/te/bugzilla_components/translate.html?match_names=check-isfuzzy,untranslated,%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E&view_mode=review
Actual Results:  
XSS possible

Expected Results:  
No XSS vulnerabilty
Comment 1 Dwayne Bailey 2010-10-29 11:50:20 EDT
This is fixed upstream for 2.1:
http://translate.svn.sourceforge.net/viewvc/translate/src/branches/Pootle-2.1/local_apps/pootle_store/views.py?r1=16167&r2=16166&pathrev=16167

This will be fixed with upstreams release of 2.1.2 bug fix release.
Comment 2 Vincent Danen 2010-10-29 16:47:52 EDT
I see that 2.1.2 is now available:

http://sourceforge.net/projects/translate/files/Pootle/2.1.2/

But the README.txt there does not mention this security flaw.  Requesting clarification on whether we can make this bug public and get updates into Fedora.
Comment 3 Vincent Danen 2010-10-29 16:48:19 EDT
Sorry, RELEASE.txt.
Comment 4 Tomas Hoger 2010-10-30 17:07:13 EDT
RELEASE.txt contains:

This release includes an important security fix to a cross site
scripting vulnerability in the translate page. All users are encouraged
to upgrade immediately.

Fedora updates are submitted already, making this public so this bug can be added to the bodhi update request.
Comment 5 Fedora Update System 2010-10-30 17:07:53 EDT
pootle-2.1.2-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc14
Comment 6 Fedora Update System 2010-10-30 17:08:20 EDT
pootle-2.1.2-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.el5
Comment 7 Fedora Update System 2010-10-30 17:08:24 EDT
pootle-2.1.2-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc13
Comment 8 Fedora Update System 2010-10-30 17:08:28 EDT
pootle-2.1.2-1.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12
Comment 9 Fedora Update System 2010-10-31 17:30:11 EDT
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update pootle'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12
Comment 10 Fedora Update System 2010-11-08 17:32:58 EST
pootle-2.1.2-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2010-11-08 17:34:28 EST
pootle-2.1.2-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2010-11-08 17:45:11 EST
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2010-11-16 12:30:57 EST
pootle-2.1.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Vincent Danen 2010-11-22 14:37:06 EST
This issue was assigned the name CVE-2010-4245.

Note You need to log in before you can comment on or make changes to this bug.