oss-sec mailing list archives
CVE Request Openstack-infra puppet-gerrit module xss vulnerability
From: Gregory Haynes <greg () greghaynes net>
Date: Tue, 21 Jun 2016 13:00:58 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Everyone, A vulnerability was discovered in the OpenStack-Infra Puppet module for Gerrit (see below). In order to ensure full traceability, we need a CVE number assigned. This issue is already public. It was recently discovered that our puppet-gerrit module configures Gerrit in a way which makes it vulnerable to a XSS attack. This stems from our configuration marking text/html as a 'safe' mimetype[1]. This configuration change was first made in May 2014[2] but we believe it did not begin working until Feb 2015[3]. Using this, a user could potentially craft a review which when visited at the proper url would have access to the account information of any user visiting that url. It is highly recommended that all downstream users of this module apply this commit[4] to protect themselves against this attack. Thanks, Greg 1: https://review.openstack.org/#/c/332219/ 2: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=346618da6d0527335b67d17dea78f7d6c55fb129 3: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=c53838ae2246f74fd5206a1bdb7b8cac656529d9 4: http://git.openstack.org/cgit/openstack-infra/puppet-gerrit/commit/?id=8573c2ee172f66c1667de49685c88fdc8883ca8b -- Gregory Haynes greg () greghaynes net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJXaX7NAAoJELwhhWqbFNDRFp4P/i8eqQYWzV6mbrPZKvYfF2HN KWleeHMIIeMVcDpC2F/3rYIla0A+SMQqrKzPkbYJh10hEbdiEG/mDuYuYkISD/pf Hud9a216bfZdj/naQzyc+0m4bae5Q7viudseX1oFDyHbSTGzEoWcPtakdp+BmYQ7 TsPJm9XsT0F29U0+hQBGOBzzkg5uP+56seou7wZ7WcmuWzLrbWGF8wPJ/XFitqjz N7VN+Ckpd2jsRvlSNCEutS10pBXeH53NB4OWOMcfhOY3Xp2w6sqP3sOopvZZvoBz u468Q2gd7bOmwfKnLKeeuO/JLrN8AJ2wH1vEXPwrVUgXj15Sf34j36XIpcLfTAVK UH3FQ/xq57sdh79Ixa3E6uhlYOtLV9jF6+1Vt9eMApue6ERuv6phmXI6Ni1BM+hW 5pFXJJN/r/rAyTaY8cZLNV56OSPIRE95sJ2bWJ535W/4Unqt+pbTK4FRPBdBJNf3 IKPeh+Uxt7f3HbUwSWA72/1qOWH5yWQs6tanovg2CGwmoTzpRwz5ho+ARjjUljHq tFfiVrsytW9bF16ffXVpUUnAAIqCWm/ZnTXlS96Xuqdj9pW0jTuW9EA8fzsYMQcL nCf8gxHTPGW87P0v9Sf3IxmKp95X3QEdy+WdoH/F/UWTEp4uqICuiMVxwawv3AFL G+xXItIFLYST0JUA0EiQ =mBX/ -----END PGP SIGNATURE-----
Current thread:
- CVE Request Openstack-infra puppet-gerrit module xss vulnerability Gregory Haynes (Jun 21)
- Re: CVE Request Openstack-infra puppet-gerrit module xss vulnerability cve-assign (Jun 22)