Bug 501280 – <dev-java/mojarra-2.2.12: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-02-14 10:16:49 UTC]

From ${URL} :

t was found that Mojarra JSF2 would not properly escape user-supplied content in certain circumstances. 
The contents of outputText tags and raw EL expressions that immediately follow <script> or <style> 
elements were not escaped. If a remote attacker could trick a user into visiting a specially-crafted URL, 
it would lead to arbitrary web script execution in the user's browser.

Upstream bug:

https://java.net/jira/browse/JAVASERVERFACES-3150

Upstream patch commit:

https://java.net/projects/mojarra/sources/svn/revision/12793

External References:

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/bc-p/6370209


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Patrice Clement 2015-09-03 15:53:58 UTC]

commit fb21e83 (HEAD, master)
Author: Patrice Clement <[e-mail]>
Date:   Thu Sep 3 15:52:55 2015 +0000

    dev-java/mojarra: Version bump. Fixes security bug 501280.

    Package-Manager: portage-2.2.18
    Signed-off-by: Patrice Clement <[e-mail]>

 create mode 100644 dev-java/mojarra/files/mojarra-2.2.12-Util.java.patch
 create mode 100644 dev-java/mojarra/mojarra-2.2.12.ebuild

[Comment 2 Patrice Clement 2015-09-03 15:54:28 UTC]

* commit 67e2d53
| Author: Patrice Clement <[e-mail]>
| Date:   Thu Sep 3 15:11:23 2015 +0000
|
|     www-servers/resin: Bump dev-java/mojarra SLOT to 2.2. Fixes security bug 501280.
|
|     Package-Manager: portage-2.2.18
|     Signed-off-by: Patrice Clement <[e-mail]>
|
|  create mode 100644 www-servers/resin/resin-4.0.44-r2.ebuild

[Comment 3 Patrice Clement 2015-09-03 16:00:36 UTC]

This package has never been stabilised.

monsieurp@epsilon ~/gentoo/dev-java/mojarra $ grep KEYWORDS *.ebuild
mojarra-1.2.15-r2.ebuild:KEYWORDS="amd64 x86"
mojarra-2.2.12.ebuild:KEYWORDS="~amd64 ~x86"
mojarra-2.2.9.ebuild:KEYWORDS="~amd64 ~x86"

commit 06a6731 (HEAD, master)
Author: Patrice Clement <[e-mail]>
Date:   Thu Sep 3 15:57:56 2015 +0000

    dev-java/mojarra: Remove vulnerable versions. Fixes bug 501280.

    Package-Manager: portage-2.2.18
    Signed-off-by: Patrice Clement <[e-mail]>

 delete mode 100644 dev-java/mojarra/files/mojarra-2.2.9-Util.java.patch
 delete mode 100644 dev-java/mojarra/mojarra-1.2.15-r2.ebuild
 delete mode 100644 dev-java/mojarra/mojarra-2.2.9.ebuild

Arch teams,

Please stabilise:
dev-java/mojarra-2.2.12.ebuild

Target arches:
amd64 x86

Thank you.

[Comment 4 Patrice Clement 2015-09-03 16:04:04 UTC]

My mistake: mojarra-1.2.15-r2 was stable but the only rdep was resin and I have just bumped it. resin being in ~arch, I shouldn't be breaking the tree.

[Comment 5 Kristian Fiskerstrand (RETIRED) 2015-09-05 14:31:58 UTC]

GLSA Vote: No

[Comment 6 Agostino Sarubbo 2015-09-05 14:58:20 UTC]

amd64 stable

[Comment 7 Agostino Sarubbo 2015-09-05 14:59:19 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 8 Patrice Clement 2015-09-05 15:02:32 UTC]

Clean up done already.

[Comment 9 Mikle Kolyada (RETIRED) 2015-09-05 19:23:48 UTC]

GLSA vote: no.