Bug 6568 - bugzilla security vulnerability (CVE-2015-4499)(CVE-2018-5123)
: bugzilla security vulnerability (CVE-2015-4499)(CVE-2018-5123)
Product: Websites
Classification: ROSA Infrastructure
Component: Bugzilla
: unspecified
: All Linux
: Normal normal
: ---
Assigned To: ROSA Linux Bugs
: ROSA Linux Bugs
Depends on:
  Show dependency treegraph
Reported: 2016-01-12 15:01 MSK by Zombie Ryushu
Modified: 2018-04-21 21:35 MSD (History)
3 users (show)

See Also:
RPM Package:
Bad POT generating:


Note You need to log in before you can comment on or make changes to this bug.
Description Zombie Ryushu 2016-01-12 15:01:12 MSK
Login names (usually an email address) longer than 127 characters are
silently truncated in MySQL which could cause the domain name of the email
address to be corrupted. An attacker could use this vulnerability to
create an account with an email address different from the one originally
requested. The login name could then be automatically added to groups
based on the group's regular expression setting (CVE-2015-4499).

During the generation of a dependency graph, the code for the HTML image
map is generated locally if a local dot installation is used. With escaped
HTML characters in a bug summary, it is possible to inject unfiltered HTML
code in the map file which the CreateImagemap function generates. This
could be used for a cross-site scripting attack (CVE-2015-8508).
Comment 1 Giovanni Mariani 2018-03-05 18:45:18 MSK
The first CVE is fixed in the bugzilla release 5.0.1 and the second in 5.0.2;
on Rosa 2016.1 we now have 5.0.3...

If not requested for Rosa 2014.1 would close this one...
Comment 2 Zombie Ryushu 2018-03-05 18:49:49 MSK
I'd backport for 2014.1 and close.
Comment 3 Zombie Ryushu 2018-03-25 17:38:54 MSD
A CSRF vulnerability in Bugzilla's report.cgi would allow a third-party
site to extract confidential information from a bug the victim had
access to (CVE-2018-5123).
Comment 4 Giovanni Mariani 2018-04-21 21:35:17 MSD
Built and published bugzilla 5.0.4: it should fix all the issues reported here.