Bug 1903670 (CVE-2019-11556) - CVE-2019-11556 pagure: XSS via the templates/blame.html blame view.
Summary: CVE-2019-11556 pagure: XSS via the templates/blame.html blame view.
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-11556
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-02 15:45 UTC by Dhananjay Arunesh
Modified: 2021-10-28 05:27 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-10-28 05:27:56 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-12-02 15:45:46 UTC 
Pagure before 5.6 allows XSS via the templates/blame.html blame view.

References:
https://docs.pagure.org/pagure/changelog.html
https://pagure.io/pagure/c/31a0d2950ed409550074ca52ba492f9b87ec3318?branch=ab39e95ed4dc8367e5e146e6d9a9fa6925b75618
https://pagure.io/pagure/commits/master
Comment 1 Neal Gompa 2020-12-16 05:49:43 UTC 
This is already fixed in all currently maintained Fedora releases as well as EPEL 7 and EPEL 8.
Note You need to log in before you can comment on or make changes to this bug.