A path traversal issue was found in MoinMoin wiki (version 1.9.3 -1.9.5). The vulnerability resides in the AttachFile action (function _do_attachment_move in action/AttachFile.py). It fails to properly sanitize file names. Details can be found at: http://moinmo.in/SecurityFixes A fix is available at: http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 This issue has been assgined CVE-2012-6080 Reference: http://seclists.org/oss-sec/2012/q4/524
Created moin tracking bugs for this issue Affects: fedora-all [bug 890906] Affects: epel-5 [bug 890907]
(Further) References: --------------------- http://www.openwall.com/lists/oss-security/2012/12/30/6 https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599 http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 http://moinmo.in/SecurityFixes http://www.debian.org/security/2012/dsa-2593 http://ubuntu.com/usn/usn-1680-1 http://www.securityfocus.com/bid/57076 http://secunia.com/advisories/51663 http://secunia.com/advisories/51676 http://secunia.com/advisories/51696
moin-1.9.6-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
moin-1.9.6-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
moin-1.9.6-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.