CVE-2017-11482 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11482): The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. CVE-2017-11481 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11481): Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
@Maintainers please let us know when tree is clean. Thank you
https://github.com/gentoo/gentoo/pull/6514
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=745ad968f00a49b584a025bce88b95e2d89a4d8d commit 745ad968f00a49b584a025bce88b95e2d89a4d8d Author: Tomas Mozes <hydrapolic@gmail.com> AuthorDate: 2017-12-14 14:18:53 +0000 Commit: Patrice Clement <monsieurp@gentoo.org> CommitDate: 2017-12-14 18:24:52 +0000 www-apps/kibana-bin: drop old vulnerable. Bug: https://bugs.gentoo.org/640532 Package-Manager: Portage-2.3.18, Repoman-2.3.6 www-apps/kibana-bin/Manifest | 5 --- www-apps/kibana-bin/kibana-bin-5.5.2.ebuild | 66 ----------------------------- www-apps/kibana-bin/kibana-bin-5.6.4.ebuild | 66 ----------------------------- www-apps/kibana-bin/kibana-bin-6.0.0.ebuild | 61 -------------------------- 4 files changed, 198 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=71f119b80cf06485afcb802689f48ae24dc39642 commit 71f119b80cf06485afcb802689f48ae24dc39642 Author: Tomas Mozes <hydrapolic@gmail.com> AuthorDate: 2017-12-14 14:18:04 +0000 Commit: Patrice Clement <monsieurp@gentoo.org> CommitDate: 2017-12-14 18:24:50 +0000 www-apps/kibana-bin: version bump to 5.6.5/6.0.1. Bug: https://bugs.gentoo.org/640532 Package-Manager: Portage-2.3.18, Repoman-2.3.6 Closes: https://github.com/gentoo/gentoo/pull/6514 www-apps/kibana-bin/Manifest | 3 ++ www-apps/kibana-bin/kibana-bin-5.6.5.ebuild | 66 +++++++++++++++++++++++++++++ www-apps/kibana-bin/kibana-bin-6.0.1.ebuild | 61 ++++++++++++++++++++++++++ 3 files changed, 130 insertions(+)}
(In reply to Christopher Díaz Riveros from comment #1) > @Maintainers please let us know when tree is clean. > > Thank you Tree clean.
