Bug 507512 – <mail-client/roundcube-1.0.2: XSS issue in the addressbook group name field (CVE-2013-5646)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description renato gallo 2014-04-12 15:38:17 UTC]

Features:

Cleaned up the configuration into a single file
Importing email messages and contact group assignments
Advanced LDAP address book functionality
Toggle to switch between HTML and plaintext view
Save Drafts to local storage for recovery
Canned responses to save and recall boilerplate texts
Improved keyboard navigation in messages list
Optimized UI to work on tablet and mobile devices
Attachment reminder plugin
With the announcement, they have also introduced the Roundcube Plugin Repository. http://plugins.roundcube.net/

Reproducible: Always

Steps to Reproduce:
1. emerge roundcube
Actual Results:  
it emerges the old version

Expected Results:  
it emerges 1.0.0

[Comment 1 David Heidelberg (okias) 2014-04-17 18:17:30 UTC]

done in ::ixit overlay, feel free to use it.

BEWARE: you should move configuration into defaults.inc.php but it will work with old config anyway, so no need to rush.

[Comment 2 Michael Orlitzky 2014-04-20 02:56:41 UTC]

There are three new bundled libs that should be removed from program/lib and added as dependencies:

  * dev-php/PEAR-Crypt_GPG (program/lib/Crypt)
  * dev-php/PEAR-Net_Sieve (program/lib/Sieve)
  * dev-php/PEAR-Net_Socket (program/lib/Net/Socket.php)

Please also address bug #489970 during the bump.

[Comment 3 Philippe Chaintreuil 2014-05-13 20:54:06 UTC]

Note: 1.0.1 has been released, so we might just want to jump to that.  See bug #510264.

[Comment 4 Jeroen Roovers (RETIRED) 2014-05-14 01:37:37 UTC]

*** Bug 510264 has been marked as a duplicate of this bug. ***

[Comment 5 Philippe Chaintreuil 2014-06-04 16:30:49 UTC]

Created attachment 378270 [details]
roundcube-1.0.1.ebuild

I made the changes requested in comment #2 above to okias's earlier mentioned ebuild, he's accepted the changes on github @ https://github.com/okias/ixit/tree/master/mail-client/roundcube -- I've attached the file for ease-of-use.

[Comment 6 Jeroen Roovers (RETIRED) 2014-06-14 21:10:43 UTC]

1.0-beta fixed an XSS issue in the addressbook group name field.

The release notes at http://trac.roundcube.net/wiki/Changelog further add a fix, released in 1.0.0 for an unspecified "security issue in DomainFactory? driver of Password plugin".

Furthermore, a security issue was found in 1.0-beta with a "wrong rule in .htaccess".

Furthermore, 1.0.1 fixed an "XSS issue in plain text spellchecker"[2] that was apparently found in 1.0.0, and was later demoted to a "Mail composing" issue because "[y]ou can only XSS yourself with this".

I stopped looking for more vulnerabilities after this.

[1] http://trac.roundcube.net/ticket/1489477
[2] http://trac.roundcube.net/ticket/1489806

[Comment 7 Daniel Kenzelmann 2014-07-23 08:22:58 UTC]

Roundcube 1.0.2 was released:
http://roundcube.net/news/2014/07/20/update-1.0.2-released/

[Comment 8 Dennis Schridde 2014-08-10 17:06:11 UTC]

News?

[Comment 9 Jeroen Roovers (RETIRED) 2014-08-12 10:53:27 UTC]

Arch teams, please test and mark stable:
=mail-client/roundcube-1.0.2
=dev-php/PEAR-Crypt_GPG-1.3.2
Targeted stable KEYWORDS : amd64 arm ppc x86

Arch teams, please test and keyword:
=mail-client/roundcube-1.0.2
=dev-php/PEAR-Crypt_GPG-1.3.2
Targeted unstable KEYWORDS : ppc64 sparc

[Comment 10 Agostino Sarubbo 2014-08-12 15:08:18 UTC]

amd64 stable

[Comment 11 Agostino Sarubbo 2014-08-12 15:25:35 UTC]

x86 stable

[Comment 12 Raúl Porcel (RETIRED) 2014-08-20 11:33:47 UTC]

arm stable, and ~sparc done

[Comment 13 Agostino Sarubbo 2014-08-30 17:07:52 UTC]

ppc64 done.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 14 Kristian Fiskerstrand (RETIRED) 2014-09-01 19:58:25 UTC]

No GLSA for Cross Site Scripting

[Comment 15 Yury German 2014-09-10 05:00:00 UTC]

As per Jer's STABLEREQ add

Please correct me if I am wrong but based on comment 9 PPC stabilization was missed for :

=mail-client/roundcube-1.0.2
=dev-php/PEAR-Crypt_GPG-1.3.2

Setting back to stable from (noglsa/cleanup), adding ppc arch.

[Comment 16 Agostino Sarubbo 2014-09-14 07:51:25 UTC]

ppc stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 17 Kristian Fiskerstrand (RETIRED) 2014-09-14 20:42:57 UTC]

(In reply to Agostino Sarubbo from comment #16)
> ppc stable.
> 
> Maintainer(s), please cleanup.
> Security, please vote.

Still no GLSA for XSS. 

Maintainer(s), please cleanup.

[Comment 18 Michael Orlitzky 2014-10-04 16:23:12 UTC]

*** Bug 508202 has been marked as a duplicate of this bug. ***

[Comment 19 Michael Orlitzky 2014-10-04 16:23:56 UTC]

It looks like we're still missing hppa and ppc64 stabilizations on both,

  =mail-client/roundcube-1.0.2
  =dev-php/PEAR-Crypt_GPG-1.3.2

Is ppc64 a stable arch? The "Add arches" box in Bugzilla suggests that it is, but if not, feel free to ignore. HPPA however I'm pretty sure is a stable arch.

[Comment 20 Jeroen Roovers (RETIRED) 2014-10-04 20:43:19 UTC]

(In reply to Michael Orlitzky from comment #19)
> It looks like we're still missing hppa and ppc64 stabilizations on both,
> 
>   =mail-client/roundcube-1.0.2

http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/mail-client/roundcube/roundcube-0.9.5.ebuild?hideattic=0&view=markup

KEYWORDS="amd64 arm ~hppa ppc ~ppc64 ~sparc x86"

They were never stable to begin with.

>   =dev-php/PEAR-Crypt_GPG-1.3.2

Maybe that's for another stabilisation bug.

[Comment 21 Michael Orlitzky 2014-10-04 20:55:34 UTC]

Ah I see, sorry for the noise. Just wanted to be sure.

[Comment 22 Sean Amoss (RETIRED) 2015-01-17 21:25:57 UTC]

This is cleaned up now.