Bug 1417865 (CVE-2015-2180) - CVE-2015-2180 roundcubemail: New password not sanitized against injecting shell meta characters in DBMail driver
Summary: CVE-2015-2180 roundcubemail: New password not sanitized against injecting she...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-2180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1417866 1417867
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-31 10:37 UTC by Andrej Nemec
Modified: 2019-09-29 14:05 UTC (History)
5 users (show)

Fixed In Version: roundcubemail 1.1.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-03-14 15:22:08 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-01-31 10:37:04 UTC 
Roundcube is shipped with the Password plugin. It is, as any other plugin, disabled by default. Once enabled, it allows an authenticated user to change his current password in the web interface. For this purpose, the plugin offers several drivers that can be used to perform the actual password change in the back end.

The DBMail driver suffers from a critical Remote Command Execution vulnerability that enables an attacker to execute arbitrary system commands with root privileges.

Upstream bug:

https://github.com/roundcube/roundcubemail/issues/4757

Upstream patch:

https://github.com/roundcube/roundcubemail/commit/7c96646de0efda16cded8491138bfefe31aca940
Comment 1 Andrej Nemec 2017-01-31 10:38:16 UTC 
Created roundcubemail tracking bugs for this issue:

Affects: epel-5 [bug 1417867]
Affects: epel-6 [bug 1417866]
Note You need to log in before you can comment on or make changes to this bug.