ROSA Linux Bugzilla – Bug 6568
bugzilla security vulnerability (CVE-2015-4499)(CVE-2018-5123)
Last modified: 2018-04-21 21:35:17 MSD
Login names (usually an email address) longer than 127 characters are
silently truncated in MySQL which could cause the domain name of the email
address to be corrupted. An attacker could use this vulnerability to
create an account with an email address different from the one originally
requested. The login name could then be automatically added to groups
based on the group's regular expression setting (CVE-2015-4499).
During the generation of a dependency graph, the code for the HTML image
map is generated locally if a local dot installation is used. With escaped
HTML characters in a bug summary, it is possible to inject unfiltered HTML
code in the map file which the CreateImagemap function generates. This
could be used for a cross-site scripting attack (CVE-2015-8508).
The first CVE is fixed in the bugzilla release 5.0.1 and the second in 5.0.2;
on Rosa 2016.1 we now have 5.0.3...
If not requested for Rosa 2014.1 would close this one...
I'd backport for 2014.1 and close.
A CSRF vulnerability in Bugzilla's report.cgi would allow a third-party
site to extract confidential information from a bug the victim had
access to (CVE-2018-5123).
Built and published bugzilla 5.0.4: it should fix all the issues reported here.