Summary: | <www-apps/bugzilla-{3.2.3, 3.3.4} attachment.cgi CSRF (CVE-2009-1213) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Robert Buchholz (RETIRED) <rbu> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | web-apps |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.bugzilla.org/security/3.2.2/ | ||
Whiteboard: | B4 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Robert Buchholz (RETIRED)
2009-04-01 23:45:59 UTC
quoting Mozilla: Versions: Every version before 3.2.3 or 3.3.4 Fixed In: 3.2.3, 3.3.4 Description: Attachment editing was vulnerable to a cross-site request forgery, because it did not validate that calls to attachment.cgi actually came from Bugzilla. Bugzilla now generates a token that is validated when an attachment is edited. Unfortunately, a fix for this issue was only possible for 3.2.3 and 3.3.4. Fixing it on earlier branches was not possible as attachment timestamps are not available to generate and validate tokens. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=476603 GLSA with bug 239564, bug 258592, bug 264572, bug 284824, bug 303437, and bug 303725. GLSA 201006-19 |