Bug 1115770 (CVE-2014-4907) - CVE-2014-4907 pnp4nagios: cross-site scripting flaw in an error page
Summary: CVE-2014-4907 pnp4nagios: cross-site scripting flaw in an error page
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-4907
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1115771 1115772
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-03 05:31 UTC by Murray McAllister
Modified: 2019-09-29 13:19 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-10-02 08:02:36 UTC
Embargoed:

Attachments (Terms of Use)

Description Murray McAllister 2014-07-03 05:31:41 UTC 
The 0.6.22 release of PNP4Nagios fixes a cross-site scripting flaw in an error page. An attacker could use this flaw to perform cross-site scripting attacks.

References:

https://bugs.gentoo.org/show_bug.cgi?id=516078
http://docs.pnp4nagios.org/pnp-0.6/dwnld
http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9/

CVE request:

http://www.openwall.com/lists/oss-security/2014/07/03/1
Comment 1 Murray McAllister 2014-07-03 05:33:25 UTC 
Created pnp4nagios tracking bugs for this issue:

Affects: fedora-all [bug 1115771]
Affects: epel-all [bug 1115772]
Comment 2 Vasyl Kaigorodov 2014-07-11 10:34:59 UTC 
CVE-2014-4907 assigned: http://seclists.org/oss-sec/2014/q3/140
Comment 3 Fedora Update System 2014-07-14 00:53:40 UTC 
pnp4nagios-0.6.22-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-07-14 00:54:44 UTC 
pnp4nagios-0.6.22-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-07-20 17:59:26 UTC 
pnp4nagios-0.6.22-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Jan ONDREJ 2014-10-01 11:13:23 UTC 
I don't understand. pnp4nagios has been already released in Fedora. Is this still a bug? Do you have some patches? If it's not a bug in Fedora, why this bug has been reopened?
Comment 7 Murray McAllister 2014-10-02 08:02:36 UTC 
(In reply to Jan ONDREJ from comment #6)
> I don't understand. pnp4nagios has been already released in Fedora. Is this
> still a bug? Do you have some patches? If it's not a bug in Fedora, why this
> bug has been reopened?

I did not close this bug earlier, sorry about that.
Note You need to log in before you can comment on or make changes to this bug.