Bug 647832 (CVE-2010-4245) - CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page
Summary: CVE-2010-4245 pootle: XSS via 'match_names' parameter on translate.html page
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-4245
Product: Fedora
Classification: Fedora
Component: pootle
Version: 13
Hardware: All
OS: Linux
low
urgent
Target Milestone: ---
Assignee: Dwayne Bailey
QA Contact: Fedora Extras Quality Assurance
URL: http://www.xssed.com/mirror/70160/
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-10-29 15:48 UTC by Dwayne Bailey
Modified: 2010-11-22 19:37 UTC (History)
2 users (show)

Fixed In Version: pootle-2.1.2-1.el5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-08 22:33:06 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Mozilla Foundation 606502 None None None Never

Description Dwayne Bailey 2010-10-29 15:48:16 UTC
User-Agent:       Mozilla/5.0 (X11; Linux i686; rv:2.0b8pre) Gecko/20101029 Firefox/4.0b8pre

Pootle allows XSS on the match_names parameter when searching for matching check failures.



Reproducible: Always

Steps to Reproduce:
1. Run this URL https://localize.mozilla.org/te/bugzilla_components/translate.html?match_names=check-isfuzzy,untranslated,%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E&view_mode=review
Actual Results:  
XSS possible

Expected Results:  
No XSS vulnerabilty

Comment 1 Dwayne Bailey 2010-10-29 15:50:20 UTC
This is fixed upstream for 2.1:
http://translate.svn.sourceforge.net/viewvc/translate/src/branches/Pootle-2.1/local_apps/pootle_store/views.py?r1=16167&r2=16166&pathrev=16167

This will be fixed with upstreams release of 2.1.2 bug fix release.

Comment 2 Vincent Danen 2010-10-29 20:47:52 UTC
I see that 2.1.2 is now available:

http://sourceforge.net/projects/translate/files/Pootle/2.1.2/

But the README.txt there does not mention this security flaw.  Requesting clarification on whether we can make this bug public and get updates into Fedora.

Comment 3 Vincent Danen 2010-10-29 20:48:19 UTC
Sorry, RELEASE.txt.

Comment 4 Tomas Hoger 2010-10-30 21:07:13 UTC
RELEASE.txt contains:

This release includes an important security fix to a cross site
scripting vulnerability in the translate page. All users are encouraged
to upgrade immediately.

Fedora updates are submitted already, making this public so this bug can be added to the bodhi update request.

Comment 5 Fedora Update System 2010-10-30 21:07:53 UTC
pootle-2.1.2-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc14

Comment 6 Fedora Update System 2010-10-30 21:08:20 UTC
pootle-2.1.2-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.el5

Comment 7 Fedora Update System 2010-10-30 21:08:24 UTC
pootle-2.1.2-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc13

Comment 8 Fedora Update System 2010-10-30 21:08:28 UTC
pootle-2.1.2-1.fc12 has been submitted as an update for Fedora 12.
https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12

Comment 9 Fedora Update System 2010-10-31 21:30:11 UTC
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update pootle'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/pootle-2.1.2-1.fc12

Comment 10 Fedora Update System 2010-11-08 22:32:58 UTC
pootle-2.1.2-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2010-11-08 22:34:28 UTC
pootle-2.1.2-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2010-11-08 22:45:11 UTC
pootle-2.1.2-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2010-11-16 17:30:57 UTC
pootle-2.1.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Vincent Danen 2010-11-22 19:37:06 UTC
This issue was assigned the name CVE-2010-4245.


Note You need to log in before you can comment on or make changes to this bug.