Bug 1089896 (CVE-2014-1517) - CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12
Summary: CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8,...
Alias: CVE-2014-1517
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1089897 1089898
TreeView+ depends on / blocked
Reported: 2014-04-22 07:57 UTC by Murray McAllister
Modified: 2019-09-29 13:16 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2019-06-08 02:32:40 UTC

Attachments (Terms of Use)

Description Murray McAllister 2014-04-22 07:57:51 UTC
The Bugzilla 4.5.3, 4.4.3, 4.2.8, and 4.0.12 releases fix two security issues. Quoting from <http://seclists.org/bugtraq/2014/Apr/112>:

Class:       Cross-Site Request Forgery
Versions:    Bugzilla 2.0 to 4.4.2, 4.5.1 to 4.5.2
Fixed In:    4.4.3, 4.5.3
Description: The login form had no CSRF protection, meaning that
             an attacker could force the victim to log in using the
             attacker's credentials. If the victim then reports a new
             security sensitive bug, the attacker would get immediate
             access to this bug.
             Due to changes involved in the Bugzilla API, this fix is
             not backported to the 4.0 and 4.2 branches, meaning that
             Bugzilla 4.0.12 and older, and 4.2.8 and older, will
             remain vulnerable to this issue.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=713926
CVE Number:  CVE-2014-1517

Class:       Social Engineering
Versions:    Bugzilla 2.0 to 4.0.11, 4.1.1 to 4.2.7, 4.3.1 to 4.4.2,
             4.5.1 to 4.5.2
Fixed In:    4.0.12, 4.2.8, 4.4.3, 4.5.3
Description: Dangerous control characters can be inserted into
             Bugzilla, notably into bug comments. If the text, which
             may look safe, is copied into a terminal such as xterm or
             gnome-terminal, then unexpected commands could be executed
             on the local machine.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=968576
CVE Number:  none

Comment 1 Murray McAllister 2014-04-22 07:59:30 UTC
Created bugzilla tracking bugs for this issue:

Affects: fedora-all [bug 1089897]
Affects: epel-all [bug 1089898]

Comment 3 Product Security DevOps Team 2019-06-08 02:32:40 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Note You need to log in before you can comment on or make changes to this bug.