oss-sec mailing list archives
[SECURITY ISSUES] CVE-2016-3691 and CVE-2016-3114
From: Andrew Shadura <andrew () shadura me>
Date: Mon, 2 May 2016 19:22:30 +0200
Hello everyone, We've discovered the following security issues in Kallithea. CVE-2016-3114: Privilege escalation =================================== The vulnerability that allowed logged-in users to edit or delete open pull requests associated with any repository to which they had read access, plus a related vulnerability allowing logged-in users to delete any comment from any repository, provided they could determine the comment ID and had read access to just one repository. CVE-2016-3691: CSRF protection bypass ===================================== Routes allows GET requests to override the HTTP method, which breaks the Kallithea CSRF protection (which only applies to POST requests). The attacker might misuse GET requests method overriding to trick user into issuing a request with a different method, thus bypassing the CSRF protection. Resolution ========== Søren Løvborg wrote patches fixing these issues, both of which are included in the release 0.3.2. Users are advised to upgrade as soon as possible. -- Cheers, Andrew
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- [SECURITY ISSUES] CVE-2016-3691 and CVE-2016-3114 Andrew Shadura (May 02)