Bug 843919 - (CVE-2012-1969) CVE-2012-1969 bugzilla: information leak (description of private attachments)
CVE-2012-1969 bugzilla: information leak (description of private attachments)
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120726,repor...
: Security
Depends On: 843921 843920
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-27 12:34 EDT by Vincent Danen
Modified: 2015-06-29 20:29 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-07-27 12:34:07 EDT
From the upstream advisory [1]:

Class:       Information Leak
Versions:    2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
Fixed In:    3.6.10, 4.0.7, 4.2.2, 4.3.2
Description: The description of a private attachment could be visible
             to a user who hasn't permissions to access this attachment
             if the attachment ID is mentioned in a public comment in
             a bug that the user can see.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=777586
CVE Number:  CVE-2012-1969

This issue would affect Bugzilla as provided by all versions of Fedora and EPEL.

Additionally, another flaw is noted in the same advisory (CVE-2012-1968: information leak via HTML bug mails), but that flaw only affects Bugzilla 4.1.1 and higher (which is not yet provided in Fedora, but 4.2.1 is in Rawhide, which should be updated to 4.2.2).

[1] http://www.bugzilla.org/security/3.6.9/
Comment 1 Vincent Danen 2012-07-27 12:36:30 EDT
Created bugzilla tracking bugs for this issue

Affects: fedora-all [bug 843920]
Affects: epel-all [bug 843921]
Comment 2 Fedora Update System 2012-08-12 22:21:42 EDT
bugzilla-4.0.7-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2012-08-12 22:22:03 EDT
bugzilla-4.0.7-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.