Werner Fink found and fixed an XSS problem in info2html.
Created attachment 57960 [details, diff] info2html-xss.diff Suse patch against 1.1
Tom please advise, I'm not sure we're affected by this one.
Auditors/patchers please advise.
$ QUERY_STRING='(coreutils) <foo bar="baz">foobar</foo>' ./info2html Expires: Sat, 31 Jan 1970 00:00:00 GMT Date: Thu, 12 May 2005 14:35:23 GMT Content-Type: text/html; charset=ISO-8859-1 <head> <title>Info Files - Error Message</title> <h1>Error</h1> </head> <body> The Info node <em> <foo bar="baz">foobar</foo></em> in Info file <em>/usr/share/info/coreutils.info.gz</em> does not exist. </body>
Thanks for the patch, now in portage as app-text/info2html-1.4-r1 (note no official release). Patch seems to work: spark info2html-1.4 # QUERY_STRING='(coreutils) <foo bar="baz">foobar</foo>' ./info2html Expires: Sat, 31 Jan 1970 00:00:00 GMT Date: Fri, 13 May 2005 19:00:54 GMT Content-Type: text/html; charset=ISO-8859-1 <head> <title>Info Files - Error Message</title> <h1>Error</h1> </head> <body> The Info node <em> <foo bar="baz">foobar</foo></em> in Info file <em>/usr/share/info/coreutils.info.gz</em> does not exist. </body> Arches, please mark stable.
Ok, events overtook me there. Contacted reporter to check when on a disclosure date.
We're free to release when we're ready. Calling individual arch testers: alpha -> kloeri hppa -> hansmi sparc -> gustavoz x86 -> tester amd64 -> blubb Please test and report back on this bug. Security we also need to decide on GLSA status, I tend to vote NO.
the patch and an updated ebuild already are in the tree, shouldn't this bug get unlocked?
We're giving SUSE a few more days to fix it, as they reported it.
I've already tested and stabled 1.4-r1 on sparc previously in one of my usual "keep the tree up to date" sprees. So, it's good for sparc and done actually.
Tested on hppa and it works fine. Should I mark it stable too?
hansmi/arches just mark it stable.
Marked stable on hppa.
Stable on alpha.
amd64 stable
jaervosz: I would go ahead and release it, SuSE said to go when we are ready.
Woops, as previously stated I tend to vote NO.
Voting NO too. Persistent XSS issues (like one that allows to post a comment on a site for everyone to unwittingly load) justify a GLSA, but link-based XSS issues (like this one, requiring tricking someone into following a very strange looking link) I tend to vote NO, except on very-widely-Internet-deployed software. jaervosz: I guess we should open it before closing ?
Closing without GLSA and opening bug.
