A reflected cross-site scripting flaw was reported in Synchronizing Key Server (SKS), and OpenPGP keyserver. A remote attacker could use this flaw to perform a cross-site scripting attack. References: https://bugzilla.mozilla.org/show_bug.cgi?id=952077 https://bitbucket.org/skskeyserver/sks-keyserver/issue/26/unfiltered-xss https://bitbucket.org/skskeyserver/sks-keyserver/pull-request/30/issue26-fix-a-non-persistent-cross-site https://bitbucket.org/kristianf/sks-keyserver-patches/src/tip/Issue26?at=default http://seclists.org/oss-sec/2014/q2/225
Created sks tracking bugs for this issue: Affects: fedora-all [bug 1093563] Affects: epel-6 [bug 1093564]
*** Bug 1093800 has been marked as a duplicate of this bug. ***
MITRE assigned CVE-2014-3207 to this issue: http://seclists.org/oss-sec/2014/q2/239
sks-1.1.5-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
sks-1.1.5-2.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.