Summary: | <www-apps/piwigo-2.10.1-r1: stored cross site scripting vulnerability (CVE-2020-8089) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | filip ambroz <filip.ambroz> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | trivial | CC: | voyageur |
Priority: | Low | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://github.com/Piwigo/Piwigo/issues/1150 | ||
Whiteboard: | ~4 [noglsa] | ||
Package list: | Runtime testing required: | --- |
Description
filip ambroz
2020-02-11 21:39:57 UTC
I am adding upstream patch with some PHP 7.4 fixes at the same time, and I will remove current 2.10.1 ebuild at the same time The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2b46d37e6fd1b061384d4fe6ad46ac54afd0a775 commit 2b46d37e6fd1b061384d4fe6ad46ac54afd0a775 Author: Bernard Cafarelli <voyageur@gentoo.org> AuthorDate: 2020-02-29 20:53:46 +0000 Commit: Bernard Cafarelli <voyageur@gentoo.org> CommitDate: 2020-02-29 20:53:46 +0000 www-apps/piwigo: backport fix for CVE-2020-8089 Drop old vulnerable version Also backport some PHP 7.4 compatibility fixes Bug: https://bugs.gentoo.org/709324 Package-Manager: Portage-2.3.89, Repoman-2.3.20 Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org> www-apps/piwigo/files/piwigo-2.10.1-css_vuln.patch | 94 ++++++++++++++++++++++ .../files/piwigo-2.10.1-php7.4_deprecation.patch | 56 +++++++++++++ .../piwigo/files/piwigo-2.10.1-php7.4_notice.patch | 41 ++++++++++ ...iwigo-2.10.1.ebuild => piwigo-2.10.1-r1.ebuild} | 7 +- 4 files changed, 197 insertions(+), 1 deletion(-) Tree is clean. |