Red Hat Bugzilla – Bug 843919
CVE-2012-1969 bugzilla: information leak (description of private attachments)
Last modified: 2015-06-29 20:29:22 EDT
From the upstream advisory :
Class: Information Leak
Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
Fixed In: 3.6.10, 4.0.7, 4.2.2, 4.3.2
Description: The description of a private attachment could be visible
to a user who hasn't permissions to access this attachment
if the attachment ID is mentioned in a public comment in
a bug that the user can see.
CVE Number: CVE-2012-1969
This issue would affect Bugzilla as provided by all versions of Fedora and EPEL.
Additionally, another flaw is noted in the same advisory (CVE-2012-1968: information leak via HTML bug mails), but that flaw only affects Bugzilla 4.1.1 and higher (which is not yet provided in Fedora, but 4.2.1 is in Rawhide, which should be updated to 4.2.2).
Created bugzilla tracking bugs for this issue
Affects: fedora-all [bug 843920]
Affects: epel-all [bug 843921]
bugzilla-4.0.7-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
bugzilla-4.0.7-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.