Bug 756348 - (CVE-2011-4345) CVE-2011-4345 namazu (v2.0.21): XSS flaw by processing HTTP cookies
CVE-2011-4345 namazu (v2.0.21): XSS flaw by processing HTTP cookies
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20110718,repor...
: Security
Depends On: 756350
Blocks:
  Show dependency treegraph
 
Reported: 2011-11-23 05:58 EST by Jan Lieskovsky
Modified: 2016-03-04 06:32 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-06 06:46:08 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-11-23 05:58:47 EST
A cross-site scripting flaw was found in the way Namazu, a full-text search engine, performed CGI parameters sanitization when processing HTTP cookies. If namazu was configured as a CGI script (WWW search engine), a remote attacker could provide a specially-crafted web page, which once processed by the engine could lead to arbitrary HTML or web script execution or allow an adversary to discover the value of HTTP cookie.

References:
[1] http://www.namazu.org/#news
[2] http://www.namazu.org/security.html.en
Comment 1 Jan Lieskovsky 2011-11-23 06:01:29 EST
This issue affects the version of the namazu package, as shipped with Fedora release of 14. Please schedule an update.
Comment 2 Jan Lieskovsky 2011-11-23 06:05:52 EST
Created namazu tracking bugs for this issue

Affects: fedora-14 [bug 756350]
Comment 3 Jan Lieskovsky 2011-11-23 06:18:09 EST
CVE request:
[3] http://www.openwall.com/lists/oss-security/2011/11/23/2
Comment 4 Jan Lieskovsky 2011-11-24 04:24:30 EST
The CVE identifier of CVE-2011-4345 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2011/11/23/8

Note You need to log in before you can comment on or make changes to this bug.