oss-sec mailing list archives
RE: [4-3801000010480] [Update 2/20/16 CVE-2015-5256] Apache Cordova vulnerable to improper application of whitelist restrictions on Android
From: security () android com
Date: Mon, 22 Feb 2016 23:54:11 +0000
Hi Thank you for the notification. We will assign this to our dev team to review. It will be tracked as AndroidID-27299922. Thanks, Quan On 02/21/16 11:56:58 csantana23 () gmail com wrote: *Updated 02/20/2016* Apache Cordova has re-visited CVE-2015-5256 "Apache Cordova vulnerable to improper application of whitelist restrictions on Android”. Upon further investigation we found that the vulnerability is more limited than was previously understood. We are lowering the severity to Low, and updating the description, affected versions, and upgrade path. The updated text of the CVE is included below: Apache Cordova PMC -------------------------- private () cordova apache org ____ *Updated 02/20/2016* CVE-2015-5256: Apache Cordova vulnerable to improper application of whitelist restrictions on Android Severity: Low Versions Affected: Cordova Android with whitelist functionality Description: Android applications created using Apache Cordova that use a remote server contain a vulnerability where whitelist restrictions for urls using protocols http and https are not properly applied. Whitelist cannot block network redirects from a whitelisted remote website to a non-whitelisted website. Upgrade path: There is no specific software patch for this vulnerability. Developers that are concerned about this should make sure to only whitelist trusted websites, and make sure that whitelisted websites don’t redirect to a malicious website. Developers using should also use SSL, as well as Content Security Policy(CSP) to further mitigate this issue. It’s always recommended for developers to upgrade to the latest version of Cordova Android. Credit: Muneaki Nishimura of Sony Digital Network Applications, Inc
Current thread:
- [Update 2/20/16 CVE-2015-5256] Apache Cordova vulnerable to improper application of whitelist restrictions on Android Carlos Santana (Feb 21)
- RE: [4-3801000010480] [Update 2/20/16 CVE-2015-5256] Apache Cordova vulnerable to improper application of whitelist restrictions on Android security (Feb 22)