Bug 479404 (CVE-2013-4795)

Summary:

<dev-python/Djblets-0.7.16: XSS (CVE-2013-4795)

Product:

Gentoo Security

Reporter:

Michael Palimaka (kensington) <kensington>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

trivial

CC:

kensington, xmw

Priority:

Normal

Version:

unspecified

Hardware:

All

OS:

Linux

Whiteboard:

~4 [noglsa]

Package list:

Runtime testing required:

---

Attachments:

Description	Flags
Initial Djblets-0.7.18 ebuild	none

Description Michael Palimaka (kensington) gentoo-dev

2013-08-01 13:59:25 UTC

* djblets.datagrid:
 * Data pulled from the database and rendered into cells are always
escaped now. Custom columns can still override this by providing
their own rendering. This led to an XSS vulnerability.

Comment 1 Joakim Tjernlund 2013-08-09 14:41:12 UTC

something holding 0.7.16 back?

Comment 2 Michael Palimaka (kensington) gentoo-dev

2013-08-09 14:42:13 UTC

(In reply to Joakim Tjernlund from comment #1)
> something holding 0.7.16 back?

Not as far as I know, just waiting for the maintainer to bump.

Comment 3 Ian Delaney (RETIRED) gentoo-dev

2013-08-16 04:03:36 UTC

like I said

Comment 4 Michael Palimaka (kensington) gentoo-dev

2013-08-16 13:07:26 UTC

(In reply to Ian Delaney from comment #3)
> like I said

?

Comment 5 Joakim Tjernlund 2013-09-15 14:05:49 UTC

Now that django 1.4.8 and 1.5.4 are in tree, can we have Djblets 0.7.16 and
0.7.17 too?

Comment 6 Joakim Tjernlund 2013-09-25 15:44:34 UTC

Created attachment 359434 [details]
Initial Djblets-0.7.18 ebuild

This is what I had to change from 0.7.15 to build 0.7.18:
--- Djblets-0.7.15.ebuild	2013-06-24 17:31:12.000000000 +0200
+++ Djblets-0.7.18.ebuild	2013-09-25 17:37:03.850366096 +0200
@@ -16,7 +16,7 @@
 KEYWORDS="~amd64 ~x86"
 IUSE="test"
 
-RDEPEND=">=dev-python/django-1.4.5[${PYTHON_USEDEP}]
+RDEPEND=">=dev-python/django-1.4.8[${PYTHON_USEDEP}]
 	<dev-python/django-1.5[${PYTHON_USEDEP}]
 	virtual/python-imaging[${PYTHON_USEDEP}]
 	>=dev-python/django-pipeline-1.2.24[${PYTHON_USEDEP}]
@@ -33,7 +33,6 @@
 		mkdir djblets/feedview/testdata || die
 		cp "${FILESDIR}"/sample.rss djblets/feedview/testdata || die
 	fi
-	epatch "${FILESDIR}"/exclude-tests.patch
 	distutils-r1_python_prepare_all
 }

Comment 7 Joakim Tjernlund 2013-09-30 08:58:44 UTC

Seems like this package has been left behind. Could some other gentoo dev bump this package?

Comment 8 Michael Palimaka (kensington) gentoo-dev

2014-04-19 18:17:05 UTC

Vulnerable versions are no longer in the tree.