Bug 213766 – net-analyzer/nagios-core < 2.11 Unspecified XSS vulnerability (CVE-2008-1360)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Robert Buchholz (RETIRED) 2008-03-18 02:17:48 UTC]

CVE-2008-1360 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1360):
  Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote
  attackers to inject arbitrary web script or HTML via unknown vectors to
  unspecified CGI scripts, a different issue than CVE-2007-5624.

[Comment 1 Robert Buchholz (RETIRED) 2008-03-18 02:19:10 UTC]

Good to go stable?

[Comment 2 Tobias Scherbaum (RETIRED) 2008-03-18 14:58:33 UTC]

yes, please.

[Comment 3 Robert Buchholz (RETIRED) 2008-03-18 15:13:16 UTC]

Arches, please test and mark stable:
=net-analyzer/nagios-core-2.11
Target keywords : "amd64 ppc64 release sparc x86"

[Comment 4 Markus Rothe (RETIRED) 2008-03-19 19:11:22 UTC]

ppc64 stable

[Comment 5 Markus Meier 2008-03-20 22:02:31 UTC]

should =net-analyzer/nagios-2.11 also go stable as it depends on ~net-analyzer/nagios-core${PV}?

[Comment 6 Tobias Scherbaum (RETIRED) 2008-03-20 22:28:28 UTC]

(In reply to comment #5)
> should =net-analyzer/nagios-2.11 also go stable as it depends on
> ~net-analyzer/nagios-core${PV}?
> 

uhrm, yeah ...

[Comment 7 Markus Meier 2008-03-21 10:30:34 UTC]

amd64/x86 stable. readding ppc64: see  comment #6

[Comment 8 Brent Baude (RETIRED) 2008-03-21 14:18:56 UTC]

ppc64 stablized =nagios-2.11 now too

[Comment 9 Raúl Porcel (RETIRED) 2008-03-22 15:37:39 UTC]

sparc stable

[Comment 10 Tobias Scherbaum (RETIRED) 2008-03-23 11:44:10 UTC]

this one is ready for glsa-vote

[Comment 11 Peter Volkov (RETIRED) 2008-03-23 12:16:03 UTC]

Fixed in release snapshot.

[Comment 12 Pierre-Yves Rofes (RETIRED) 2008-03-24 21:03:38 UTC]

XSS -> voting NO.

[Comment 13 Robert Buchholz (RETIRED) 2008-03-24 22:21:03 UTC]

NO, closing.